shivam-hr[.]github[.]io

On July 29, 2026, the domain shivam-hr.github.io was observed actively serving a generic phishing campaign. The domain is hosted on GitHub Pages, as indicated by the registration record showing GitHub, Inc. as the registrar and the resolved IP address 185.199.108.153, which belongs to the GitHub‑owned infrastructure. Google Safe Browsing has classified the site under the “social engineering” category, and the domain appears on one external security blocklist. PhishDestroy has also listed the domain as blocked, confirming that at least one dedicated anti‑phishing service is actively preventing access.

VirusTotal scans reported that 12 out of 91 security vendors flagged the domain as malicious, providing independent corroboration of its abusive nature. The nameserver query returned no results (NS_NOT_FOUND), which is consistent with the default DNS configuration for GitHub‑hosted sites. No additional metadata such as page title, SSL certificate details, or HTTP response codes are currently available, limiting the depth of the technical profile.

Analysts should treat the domain as high‑risk and consider adding it to local deny lists, enforcing web‑proxy blocks, and monitoring outbound traffic for connections to 185.199.108.153. Because the underlying hosting platform is a legitimate service, remediation may involve reporting the abuse to GitHub’s abuse handling team to expedite takedown. Continuous monitoring is recommended to detect any re‑use of the same GitHub Pages sub‑domain or the creation of new sub‑domains that target similar victims.