mandharesoham[.]github[.]io

Analysis of the domain mandharesoham.github.io indicates that it is currently active and being used for a generic phishing campaign. The site resolves to the IP address 185.199.108.153, which is part of the GitHub Pages hosting infrastructure and aligns with the registrar information that the domain was registered through GitHub, Inc. Five of the ninety‑five security vendors scanned by VirusTotal have flagged the domain, demonstrating that at least a subset of detection engines recognize malicious activity. The domain is listed on two public phishing blocklists and is explicitly blocked by PhishDestroy and OpenPhish, reinforcing the view that it is associated with credential‑stealing or fraudulent content.

Nameserver information could not be retrieved (NS_NOT_FOUND), which is typical for GitHub‑hosted pages that rely on GitHub’s internal DNS configuration. No additional artefacts such as SSL certificate details, HTTP response codes, or page‑title metadata are available at this time, so the precise appearance of the phishing page remains unverified.

Defenders should treat the domain as high‑risk: network perimeter controls ought to deny outbound connections to the associated IP, web filtering solutions should enforce blocklist entries, and endpoint security products should be updated to reflect the five vendor detections. Continuous monitoring of the domain’s resolution and any future VirusTotal or blocklist updates is recommended to capture changes in threat posture.