gshagun16[.]github[.]io

This domain, gshagun16.github.io, is currently classified as a generic phishing site with a high risk rating. The domain is hosted on GitHub Pages and resolves to the IP address 185.199.108.153, which belongs to GitHub, Inc. The registration record shows the domain was created through GitHub, Inc., confirming the use of a legitimate cloud‑hosting provider for malicious purposes. The domain appears on one external blocklist and has been flagged by the PhishDestroy sinkhole as active. VirusTotal analysis shows that five of ninety‑one scanners have identified malicious behavior, indicating that a minority of AV engines detect the phishing payload.

No additional intelligence such as Safe Browsing or Open Threat Exchange entries is available at this time, and the page title and SSL certificate details have not been disclosed. Nameserver lookup returned NS_NOT_FOUND, suggesting that the authoritative name server information could not be retrieved, which may impede rapid DNS‑based mitigation. The domain remains reachable and continues to serve content, as indicated by its active status. Defenders should block DNS resolution to 185.199.108.153 for the gshagun16.github.io host, add the domain to web filtering and email security lists, and monitor GitHub Pages traffic for similar patterns.

Because the hosting provider is a well‑known service, takedown requests may be directed to GitHub’s abuse contact if the malicious content is identified. Continuous re‑scanning with VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection rates. Until further forensic analysis of the page content is performed, the primary mitigation focus should be on network‑level blocking and user awareness of unsolicited links that claim to originate from GitHub.