shivam9984941055-hash[.]github[.]io

Analysis of shivam9984941055-hash.github.io shows a high‑risk phishing indicator set as of July 29, 2026. The domain is hosted on GitHub Pages and resolves to the shared IP address 185.199.111.153, which is owned by GitHub's content delivery network. VirusTotal reports that 16 of 91 scanned security vendors flag the domain as malicious, providing a multi‑engine consensus of suspicious behavior. The site appears on a single external security blocklist and is explicitly listed by PhishDestroy as a blocked resource.

Google Safe Browsing classifies the URL under the social engineering category, confirming the presence of deceptive content aimed at credential harvesting. Registration details indicate the domain was provisioned through GitHub Pages, a free hosting service that automatically assigns the github.io subdomain. No public SSL certificate details, HTTP status codes, or page title information are available in the current intelligence set, leaving the exact page content and any credential‑capture mechanisms unverified.

Given the convergence of multi‑vendor detections, blocklist presence, and Safe Browsing flags, defenders should treat the domain as active phishing infrastructure. Recommended mitigation steps include immediate DNS sinkholing or firewall denial of the domain, updating intrusion detection signatures to flag outbound connections to 185.199.111.153 when associated with suspicious user agents, and monitoring internal logs for any authentication attempts directed at the URL. Continuous re‑evaluation is advised, as further analysis of the hosted page could reveal additional indicators such as malicious scripts or credential‑submission endpoints.