prajn12[.]github[.]io

Analysis of the domain prajn12.github.io, registered through GitHub, Inc., confirms its classification as an active phishing endpoint. As of July 22, 2026, this domain remains operational and is flagged by multiple security mechanisms. Infrastructure analysis reveals the domain resolves to the IP address 185.199.108.153, a host associated with GitHub Pages, a common vector for phishing campaigns due to its legitimate hosting origin. The domain is listed on two security blocklists, including PhishDestroy and OpenPhish, and is explicitly blocked by these platforms.

Google Safe Browsing further categorizes the domain under 'social engineering,' indicating its use in deceptive practices targeting users. VirusTotal scans show that 6 out of 95 security vendors have flagged this domain, providing additional corroboration of its malicious nature. The absence of configured nameservers (NS_NOT_FOUND) is atypical for legitimate domains but consistent with hastily deployed phishing infrastructure. While the exact content or targeted brand of the phishing site is not yet analyzed, the combination of blocklist entries, vendor detections, and Safe Browsing classification confirms its role in phishing operations.

Defenders are advised to treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Given its hosting on GitHub Pages, organizations should monitor for similar patterns, such as subdomains under github.io, which may evade traditional detection methods. No evidence of takedown requests or mitigation efforts has been observed, and the domain remains accessible as of the report date. Further investigation into the specific phishing kit or campaign associated with this domain is recommended to assess potential linkages to broader threat actor activity.