khushboo954[.]github[.]io

This domain, khushboo954.github.io, is currently active and has been identified as a generic phishing site. The domain is hosted on GitHub Pages and was registered through GitHub, Inc. Its authoritative name server information could not be retrieved (NS_NOT_FOUND). DNS resolution points to the IP address 185.199.108.153, which belongs to GitHub's infrastructure. No SSL certificate details are available in the provided intelligence, and HTTP response codes have not been reported. VirusTotal analysis shows that the domain was scanned by 91 security vendors; none of the scanners raised a detection at the time of the scan.

While the lack of detections does not constitute confirmation of benign intent, it indicates that the payload or page content has not yet triggered known signatures. The domain is listed on a single public phishing blocklist and is actively blocked by the PhishDestroy service. The available data does not include a page title, brand target, or any observed malicious payload, so the exact phishing technique and the victim profile remain uncertain. No evidence of additional hosting, CDN, or command‑and‑control infrastructure has been disclosed. Defenders should treat khushboo954.github.io as a high‑confidence phishing indicator.

Immediate actions include adding the domain to local DNS blocklists, configuring web‑proxy filters to deny HTTP(S) requests to the host, and monitoring outbound connections for attempts to resolve or contact the IP 185.199.108.153. Because the domain resides on a shared GitHub Pages service, network‑level blocking may be preferable to avoid collateral impact on legitimate GitHub traffic. Continuous re‑scanning with VirusTotal and periodic checks against threat‑intel feeds are recommended to capture any future detections or changes in the domain’s reputation. Logging DNS queries for this host and correlating them with user‑agent strings can help identify compromised endpoints that may be targeted by the phishing campaign.