palakjha3004-ux[.]github[.]io

Analysis indicates that the domain palakjha3004-ux.github.io is currently active and being used in a generic phishing operation. The site is hosted on GitHub Pages, which assigns the IPv4 address 185.199.110.153 to the domain. Hosting under GitHub’s infrastructure provides a high‑reputation TLS certificate by default, but the presence of the domain on a security blocklist demonstrates that the content hosted on the page is considered malicious. The blocklist entry is confirmed by PhishDestroy, which has actively blocked the domain.

VirusTotal scans have returned 11 positive detections out of 91 submitted security vendors, indicating that a subset of AV engines have identified malicious behavior or payload associated with the domain. No additional intelligence such as page title, target brand, or specific phishing kit was supplied, so the exact appearance of the landing page remains unknown. The limited visibility of the site’s content creates uncertainty regarding the specific credential‑stealing techniques employed, the geographic origin of the operators, and any command‑and‑control infrastructure that may be leveraged after credential capture. Defenders should continue to block the domain at perimeter firewalls and DNS resolvers, add it to local blocklists, and monitor network traffic for outbound connections to the IP address 185.199.110.153.

Security teams should also correlate user‑agent logs and email gateways for attempts to contact the domain, and consider leveraging threat‑intel feeds that reference the 11 VirusTotal detections to enrich detection rules. Ongoing observation of the domain’s status on public blocklists and periodic rescanning with VirusTotal or similar services is recommended to track changes in detection rates. Until further content analysis is available, the domain should be treated as a high‑confidence phishing indicator.