rahul-t0mar[.]github[.]io

This domain, rahul-t0mar.github.io, is flagged as a high-risk generic phishing site targeting users with a fake checkout interface. Analysis indicates no direct association with a specific brand or crypto drainer kit, but the page title 'Checkout' suggests an intent to mimic e-commerce payment portals, likely harvesting credit card details or login credentials. The lack of a known phishing kit signature does not diminish the threat, as custom or obfuscated scripts may be employed to evade detection. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 185.199.110.153, hosted under AS54113 (Fastly, Inc.) in the United States. It is registered through GitHub, Inc., leveraging GitHub Pages for hosting, which is a common tactic to exploit legitimate infrastructure for malicious purposes. The SSL certificate is issued by Let's Encrypt (R12), providing a false sense of security. VirusTotal detection shows 6 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by a proprietary phishing detection system. No Google Safe Browsing (GSB) listing is recorded at this time, which may indicate either a recent deployment or evasion of GSB detection mechanisms. As of the latest verification, rahul-t0mar.github.io remains active, posing an ongoing risk to users. The domain's hosting on GitHub Pages complicates takedown efforts, as it operates under the guise of legitimate user-generated content. Users are advised to avoid interacting with the domain, and network administrators should implement blocklist updates to prevent access. Given the 6/95 detection rate on VirusTotal, additional security vendors may flag the domain in the near future. The absence of widespread blocklisting suggests this campaign may still be in its early stages, warranting heightened monitoring and proactive mitigation measures.