saransh-22[.]github[.]io

Analysis of the domain saransh-22.github.io indicates that it is actively being used for malicious phishing operations as of the report date July 24, 2026. The domain resolves to the IP address 185.199.108.153, which is associated with GitHub's hosting infrastructure. Registration details show the domain was created through GitHub, Inc., confirming that the underlying service is a legitimate code‑hosting platform, but the specific repository or site has been repurposed for malicious intent. Threat intelligence feeds have marked the domain as blocked by both PhishDestroy and OpenPhish, and it appears on two independent security blocklists, reinforcing the consensus that the site is hostile.

VirusTotal scans report that seven out of ninety‑one security vendors flagged the domain, providing additional corroboration of its malicious nature. The domain's nameserver information is listed as NS_NOT_FOUND, suggesting that standard DNS queries do not return conventional name server records, which may hinder some automated resolution checks. Current status is listed as active, meaning the phishing content remains reachable. Defenders should prioritize immediate containment by adding saransh-22.github.io to network‑level deny lists and updating URL filtering rules across proxy and firewall appliances.

Continuous monitoring of the associated IP address 185.199.108.153 is advised, as further malicious domains may be hosted on the same infrastructure. Given the limited public metadata, additional investigation, such as sandboxed retrieval of the page content and correlation with any credential‑stealing payloads, would help refine detection signatures. Until more detailed content analysis is available, the domain should be treated as high‑risk and blocked across all enterprise endpoints.