himeshagarwal[.]github[.]io

On July 29, 2026 analysts observed that the sub‑domain himeshagarwal.github.io is actively being used for a generic phishing campaign. The site is hosted on GitHub Pages, as indicated by the registration method and the resolved address 185.199.108.153, which belongs to the GitHub infrastructure. The domain has been added to the PhishDestroy blocklist and appears on a security blocklist. VirusTotal scans show that 13 out of 91 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of phishing activity. The threat is classified with an elevated risk level and remains active at the time of reporting.

The available evidence does not include a page title, SSL certificate details, or explicit brand targeting, so the precise content of the hosted page cannot be described. No information about the underlying HTML, JavaScript kits, or credential‑harvesting mechanisms has been released. Consequently, the exact phishing vector (e.g., credential‑stealing form, malicious download) remains uncertain. Nevertheless, the convergence of multiple detection sources—GitHub Pages hosting, blocklist inclusion, and multi‑vendor VirusTotal flags—provides a strong indicator that the domain should be treated as hostile.

Defenders should immediately add himeshagarwal.github.io to network and DNS blocklists, enforce outbound filtering for the IP 185.199.108.153, and monitor for any authentication attempts that resolve to this host. Continuous re‑scanning on VirusTotal or similar aggregators is recommended to capture any changes in vendor verdicts. Organizations employing web‑proxy or secure web‑gateway solutions should also configure rule sets to drop HTTP/HTTPS requests to this domain. Because the hosting service is a legitimate cloud platform, any takedown request should be routed through GitHub’s abuse channel, citing the phishing activity and the vendor detections.