roshansonawane021[.]github[.]io

This domain, roshansonawane021.github.io, is currently active and has been identified as a generic credential‑harvesting phishing site. The infrastructure is hosted on GitHub Pages, resolving to the IP address 185.199.108.153, which belongs to the GitHub, Inc. hosting network. The domain was registered through GitHub, Inc., and the authoritative nameserver lookup returned NS_NOT_FOUND, indicating that the typical DNS delegation information is unavailable or hidden. The site has been added to one security blocklist and is actively blocked by the PhishDestroy mitigation service, demonstrating that at least one defensive feed is already aware of the threat.

A VirusTotal analysis performed on 91 scanning engines produced no detections; however, the absence of detections does not constitute evidence of benign behavior and should not be interpreted as a clearance. No publicly available Safe Browsing, Open Threat Exchange, SSL certificate, HTTP response code, trust‑score, or page‑title data have been observed for this domain, leaving those vectors unverified. Because the domain is hosted on a reputable cloud provider, traditional reputation signals may be limited, increasing the reliance on contextual indicators such as blocklist inclusion and registrar information.

Defenders should continue to monitor DNS queries for this hostname, enforce outbound filtering to block connections to the underlying IP range, and add the domain to internal deny‑lists. Periodic re‑scanning with updated threat‑intelligence platforms is advised to capture any future payloads or malicious redirects that may be introduced. Until a definitive malicious payload is confirmed, the domain remains under investigation, and caution is warranted for any user interactions that involve credential submission.