saumyapatra[.]github[.]io

This domain, saumyapatra.github.io, is identified as a high-risk generic phishing endpoint leveraging GitHub Pages infrastructure. Analysis indicates no overt brand impersonation or drainer kit signatures at the time of assessment, though the absence of legitimate content and the presence of security vendor detections suggest malicious intent. The domain currently displays a 'Site not found' page, a common tactic to evade initial scrutiny while maintaining operational readiness for phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, associated with GitHub, Inc., and is registered through the same provider. The SSL certificate is issued by Let's Encrypt (R12), a legitimate certificate authority often exploited by threat actors to lend credibility to malicious sites. The domain was created on March 29, 2026, and is flagged by 14 out of 95 security vendors on VirusTotal. It appears on two security blocklists, including PhishDestroy and PhishingDB, though it is not currently listed in Google Safe Browsing (GSB) databases. The hosting location is confirmed as the United States. Current status remains active, with no takedown or mitigation observed as of this report. The domain's use of GitHub Pages, a trusted platform, complicates detection and response efforts, as it blends with legitimate traffic. Organizations are advised to implement network-level blocking for the domain and associated IP address, while end-users should exercise caution with any unexpected communications linking to this endpoint. Continuous monitoring is recommended due to the domain's persistence and potential for future malicious activity.