ujjaldolui1234-debug[.]github[.]io

Analysis of ujjaldolui1234-debug.github.io shows active exploitation consistent with a generic phishing campaign. The sub‑domain is provisioned through GitHub Pages, indicating that the underlying hosting infrastructure is shared with the public static‑site service operated by GitHub. VirusTotal scans report that 7 of 91 security vendors have flagged the domain, providing a modest but notable detection signal across multiple antivirus engines.

The domain also appears on a single public blocklist and is specifically blocked by the PhishDestroy feed, reinforcing the view that threat‑intel sources have observed malicious use. No additional reputation services, Safe Browsing status, or SSL certificate anomalies are reported in the available data, and the page title or any brand identifiers have not been disclosed, leaving the visual content of the site unverified. The limited detection footprint suggests that the campaign may be recent or employing low‑profile hosting to evade broader detection.

Defenders should prioritize blocking the domain at perimeter filters, incorporate the indicator into URL reputation lists, and monitor for related GitHub‑Pages sub‑domains that exhibit similar detection patterns. Continuous re‑scanning of the domain is advised, as the detection count may increase if additional samples are submitted to sandbox environments. Organizations should educate users about the risk of unsolicited links that resolve to GitHub‑Pages URLs, especially when the destination is unknown or untrusted, and enforce multi‑factor authentication to reduce credential compromise impact.