soorajvarrma[.]github[.]io

This domain, soorajvarrma.github.io, is identified as a generic phishing site leveraging GitHub Pages infrastructure. Analysis indicates no direct association with a specific brand or drainer kit, though the repository structure suggests potential credential harvesting or malicious redirection. The absence of a visible page title beyond 'Site not found' may indicate either an abandoned phishing attempt or a placeholder for future malicious activity, a common tactic to evade initial detection while maintaining operational readiness. Infrastructure analysis reveals the domain is registered through GitHub, Inc., resolving to the IP address 185.199.108.153, located in the United States. The domain is flagged by 14 out of 95 security vendors on VirusTotal, with a current status of active. It appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Let's Encrypt (R12), a standard for GitHub Pages, providing no additional indicators of compromise beyond the domain's malicious classification. No creation date is available due to GitHub's hosting model, but the domain's presence on blocklists suggests recent malicious activity. The domain remains active as of the latest verification, posing an ongoing risk to users who may encounter it through phishing campaigns or compromised links. Recommended response actions include immediate blocking at the network and endpoint levels, particularly for organizations leveraging GitHub Pages for legitimate purposes. Despite its current low visibility, the domain's persistence on security blocklists and vendor detections (14/95) indicates a credible threat. Continuous monitoring is advised to track any changes in its behavior or infrastructure, as threat actors frequently repurpose such domains for new attacks.