aditya-kr-007[.]github[.]io

Analysis indicates that the domain aditya-kr-007.github.io is currently active and is being used for generic phishing campaigns. The domain is registered through GitHub, Inc., which provides hosting for user‑generated sites under the github.io sub‑domain. DNS resolution points to the IP address 185.199.108.153, an address owned by GitHub's infrastructure. The domain does not resolve to any custom nameserver; a query for its NS records returns NS_NOT_FOUND, confirming reliance on the default GitHub nameservers. Reputation checks show that the domain appears on two independent security blocklists, specifically PhishDestroy and OpenPhish.

Google Safe Browsing classifies the site under the “social engineering” category, indicating that the URL is associated with attempts to deceive users into revealing credentials or personal data. VirusTotal analysis reports that seven out of ninety‑one scanning engines have flagged the domain as malicious, reinforcing the suspicion of malicious activity. No additional public indicators such as SSL certificate details, HTTP response codes, page titles, or threat‑actor attribution are available in the current intelligence set. Consequently, the precise phishing kit, targeted brands, or lure mechanisms remain unknown. The lack of custom nameserver information and the use of a shared hosting environment suggest that the operators are leveraging legitimate hosting services to obscure their infrastructure.

Defenders should treat traffic to aditya-kr-007.github.io as high‑risk. Network security controls ought to block or quarantine connections to the domain, and email filtering solutions should add the domain to block or quarantine lists. Endpoint detection systems can incorporate the observed VirusTotal detections as an indicator of compromise. Continuous monitoring of the IP address 185.199.108.153 is recommended, as other malicious subdomains may be hosted on the same GitHub infrastructure.