purvai31[.]github[.]io

On July 24, 2026, the domain purvai31.github.io was observed actively hosting a generic phishing operation. The domain is registered through GitHub, Inc., leveraging the GitHub Pages hosting service, and resolves to the IP address 185.199.108.153. No authoritative name server information is available (NS_NOT_FOUND), but the resolution to a GitHub‑controlled address confirms the use of a legitimate cloud‑based content platform, a pattern frequently abused by threat actors to obtain a trusted TLS certificate and reduce detection latency. The infrastructure has been flagged by two independent phishing blocklists, PhishDestroy and OpenPhish, and appears on a total of two security blocklists.

VirusTotal scans have returned eight positive detections out of ninety‑one submitted security vendors, indicating that multiple anti‑malware engines have identified malicious activity linked to this host. Despite these indicators, the domain remains listed as active. Given the limited publicly available metadata, the exact target brand or credential‑stealing page content has not been disclosed. Analysts should therefore treat the domain as a high‑risk phishing vector until further forensic evidence is gathered.

Defensive recommendations include adding purvai31.github.io to DNS‑based blocklists, configuring web‑proxy filters to deny HTTP/HTTPS requests to the domain, and monitoring outbound connections to the associated IP address 185.199.108.153 for anomalous traffic. Organizations employing threat‑intelligence platforms should ingest the blocklist identifiers and VirusTotal detection count to enrich existing detection rules. Continuous re‑evaluation is advised, as the hosting provider may change the underlying IP without notice, potentially affecting mitigation efficacy.