saniya-s4[.]github[.]io

Analysis indicates that the domain saniya-s4.github.io was registered through GitHub, Inc. and resolves to the IP address 185.199.108.153, which belongs to GitHub's hosting infrastructure. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy list, confirming that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal has collected scans from 91 security vendors, of which 16 returned a positive detection, reinforcing the suspicion of malicious activity.

The lack of a resolvable nameserver entry (NS_NOT_FOUND) is consistent with GitHub Pages configurations, where DNS is managed by GitHub and often does not expose conventional NS records. No additional intelligence such as SSL certificate details, HTTP response codes, page title, or brand targeting has been disclosed, leaving the exact phishing vector undefined. The current evidence points to a generic phishing operation that leverates the trust of the github.io subdomain to host deceptive content.

Defenders should treat the domain as hostile: add it to URL filtering rules, ensure endpoint protection solutions block connections to 185.199.108.153 when used for suspicious activity, and monitor threat‑intel feeds for any updates. Because the hosting platform is shared, blocking the entire github.io subdomain may cause collateral impact; therefore, precise rule creation targeting the full host name is recommended. Continuous re‑evaluation is advised in case the domain’s status changes or additional detections emerge.