anjani-kumar75[.]github[.]io

The domain anjani-kumar75.github.io is currently identified as an active phishing infrastructure specifically targeting PayPal users. Analysis confirms this as a brand impersonation threat, designed to harvest credentials or financial data under the guise of legitimate PayPal communications. The site remains operational despite detection by multiple security mechanisms, posing a high risk to unsuspecting visitors. Infrastructure analysis reveals the domain is registered through GitHub, Inc., resolving to the IP address 185.199.110.153, located in the United States. The domain was created on April 14, 2026, and is currently flagged by 15 out of 95 security vendors on VirusTotal. It appears on one security blocklist and is explicitly labeled as phishing by Google Safe Browsing. The SSL certificate is issued by Let's Encrypt (R12), and the page title displays 'Site not found · GitHub Pages,' which may indicate an attempt to evade detection or a placeholder for malicious content. Current status indicates the domain remains active and unmitigated, despite clear indicators of compromise. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the IP address 185.199.110.153. Users should be alerted to the threat, particularly those who may receive communications referencing PayPal. Monitoring for similar GitHub Pages-hosted domains is recommended, as this infrastructure is frequently exploited for low-cost, high-impact phishing campaigns.