satbhai444[.]github[.]io

satbhai444.github.io is currently flagged as a high‑risk generic phishing site. The domain resolves to the IPv4 address 185.199.108.153, which belongs to the GitHub Pages infrastructure operated by GitHub, Inc. The registration is listed under GitHub, Inc., indicating that the domain was created through the standard GitHub account provisioning process. No authoritative nameservers were returned for the domain (NS_NOT_FOUND), which is consistent with GitHub’s default DNS handling for user‑generated pages. VirusTotal has recorded detections from 14 out of 91 scanned security vendors, confirming that multiple independent scanners consider the payload malicious. Google Safe Browsing classifies the URL as a social engineering threat, and the domain is actively blocked by the PhishDestroy service.

Additionally, the domain appears on one external security blocklist, further supporting its malicious reputation. While the infrastructure points to a legitimate hosting provider, the presence of multiple vendor detections and the Safe Browsing flag indicate that the content hosted at the URL is being used for phishing. The exact page content, page title, and credential‑harvesting mechanisms have not been publicly disclosed, so the specific deceptive technique remains unknown. The lack of visible nameserver data also limits the ability to trace upstream DNS changes.

Defenders should add 185.199.108.153 and the fully‑qualified domain name satbhai444.github.io to outbound and inbound blocklists, enforce URL filtering policies that reference Google Safe Browsing and PhishDestroy feeds, and monitor for any newly observed sub‑domains under the github.io namespace that exhibit similar detection patterns. Continuous re‑scanning with VirusTotal or comparable multi‑engine services is recommended to capture any changes in the domain’s detection profile.