gunpreetsingh25[.]github[.]io

This domain, gunpreetsingh25.github.io, is flagged as a high-risk generic phishing resource designed to harvest user credentials through social engineering tactics. Analysis indicates no direct association with known brand impersonation or cryptocurrency drainer kits, though its infrastructure aligns with credential theft campaigns. The threat actor appears to leverage GitHub's hosting service to evade initial detection while maintaining operational persistence. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, a GitHub Pages server operated by GitHub, Inc. The SSL certificate is issued by Let's Encrypt, a common tactic to create false legitimacy. VirusTotal detection metrics show 0/95 engines flagging the domain as malicious, suggesting either recent deployment or effective evasion techniques. Google Safe Browsing categorizes the domain under SOCIAL_ENGINEERING, confirming its use in deceptive practices. No historical registration data is available due to the domain's GitHub Pages origin, limiting temporal attribution. The domain remains active as of analysis, with no observed takedown actions or blocklist inclusions beyond Google Safe Browsing. Users encountering this domain should immediately terminate sessions and avoid inputting credentials or personal data. Network administrators are advised to implement DNS-based blocking for 185.199.108.153 and monitor for related subdomains under the gunpreetsingh25.github.io namespace. Despite the current lack of widespread detection, the domain's active social engineering status and GitHub-hosted infrastructure present a persistent high-risk vector for credential compromise.