shivnandan20070102-tech[.]github[.]io

The domain shivnandan20070102-tech.github.io is currently flagged as an active phishing resource leveraging GitHub Pages infrastructure to impersonate legitimate GitHub services. Analysis indicates this is not a generic phishing attempt but a targeted brand impersonation campaign, likely designed to harvest credentials or distribute malicious payloads under the guise of a non-existent GitHub repository. The page title, 'Site not found · GitHub Pages,' serves as a deceptive facade to mask the true intent of the domain while maintaining plausible deniability within the hosting environment. Infrastructure analysis reveals the domain resolves to the IP address 185.199.110.153, located within the United States under AS54113 (Fastly, Inc.), a network frequently utilized for content delivery and legitimate hosting. Despite its benign appearance, the domain has been flagged by 7 of 95 security vendors on VirusTotal, a detection ratio that underscores its malicious classification. The domain is registered through GitHub, Inc., and employs a Let's Encrypt SSL certificate (R12), which, while standard for secure connections, does not mitigate the underlying threat. Currently, the domain appears on one security blocklist, specifically PhishDestroy, further corroborating its phishing classification. As of the latest assessment, shivnandan20070102-tech.github.io remains active, posing a continued risk to users who may inadvertently interact with the domain. The combination of GitHub Pages hosting, minimal blocklist presence, and the 'Site not found' ruse suggests an attempt to evade detection while maintaining operational persistence. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include this indicator of compromise. Users should exercise caution when encountering GitHub Pages domains with irregular naming conventions or unexpected redirects, as these may indicate similar phishing attempts. Security teams are encouraged to monitor for additional domains registered under the same pattern, as this campaign may expand to include further impersonation efforts.