priyagarg2518[.]github[.]io

This domain is flagged as a high-risk credential harvesting phishing site targeting users through deceptive GitHub Pages infrastructure. Analysis indicates the domain is designed to impersonate trusted platforms, tricking victims into submitting sensitive login details or personal information under false pretenses. The threat type is classified as generic_phishing, with a focus on credential theft and potential follow-on exploitation. Infrastructure analysis reveals the domain was registered on April 16, 2026, through GitHub, Inc., and currently resolves to the IP address 185.199.111.153, hosted in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Security vendor detections on VirusTotal report 10 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The page title, 'Site not found · GitHub Pages,' suggests either a placeholder or an attempt to evade detection by appearing inactive. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (185.199.111.153) at the network perimeter. Organizations should deploy endpoint protection rules to prevent access to the domain and monitor for any attempts to reach it. User awareness training should emphasize the risks of GitHub Pages-based phishing, particularly domains with unusual naming conventions or recent creation dates. If credentials were entered on this domain, affected accounts should be locked, passwords reset, and multi-factor authentication enforced. Network logs should be reviewed for connections to 185.199.111.153 or related subdomains to identify compromised systems.