saranshgupta-dev[.]github[.]io

This domain, saranshgupta-dev.github.io, is flagged as a high-risk phishing site designed to mimic legitimate GitHub Pages infrastructure. While the visible page title reads 'Site not found · GitHub Pages,' analysis indicates the underlying infrastructure is actively abused for credential harvesting or malware distribution. The domain leverages GitHub's hosting services, which are often exploited due to their trusted reputation and free availability, making detection more challenging for unsuspecting users. Infrastructure analysis reveals the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, a known GitHub Pages endpoint. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. At the time of assessment, 7 out of 95 security vendors on VirusTotal have flagged this domain as malicious, confirming its use in phishing campaigns. The domain remains active, suggesting ongoing or recent abuse. If you or someone in your organization has visited saranshgupta-dev.github.io, immediate action is required. First, disconnect the affected device from the network to prevent potential data exfiltration. Next, revoke any credentials that may have been entered on the site, particularly those linked to GitHub or other sensitive accounts. Scan the device using updated security tools to detect any installed malware or unauthorized changes. Monitor accounts for unusual activity, such as unauthorized logins or transactions. Report the domain to your security team or relevant authorities to aid in broader mitigation efforts. Avoid clicking on any links or downloading files from untrusted sources, even if they appear to originate from familiar services.