karanperumal[.]github[.]io

The domain karanperumal.github.io is currently active and hosted on GitHub Pages infrastructure, as indicated by the registration through GitHub, Inc. and the IP address 185.199.108.153, which belongs to the GitHub Pages CDN network. The site presents a valid TLS certificate issued by Let’s Encrypt (YR2), confirming that HTTPS connections are properly encrypted. Passive DNS queries return no authoritative name server information (NS_NOT_FOUND), which is typical for GitHub‑provided subdomains that rely on GitHub’s internal DNS resolution. VirusTotal has recorded 7 detections out of 91 analyzed scanners, suggesting that multiple security engines have flagged the domain for malicious behavior consistent with phishing activity. The threat classification assigned is generic_phishing with a high risk rating, indicating that the domain is likely used to harvest credentials or lure victims into divulging sensitive information. No additional infrastructure such as dedicated hosting, external C‑2 servers, or malware payloads is observable from the available data, and the content of the web pages has not been examined. Defenders should continue to monitor the domain, block network connections to 185.199.108.153 when associated with suspicious email or credential‑submission flows, and consider adding the domain to URL filtering rules. Further investigation, including page content retrieval and dynamic analysis, is required to confirm the exact phishing vectors and to determine if the site hosts credential‑capture forms or redirects to other malicious hosts.