ranvijayysinghrathore[.]github[.]io

Analysis as of July 29 2026 indicates that the GitHub Pages subdomain ranvijayysinghrathore.github.io is currently flagged as a phishing host. The domain is registered through GitHub, Inc., which is the default registrar for GitHub‑hosted pages, and resolves to the IP address 185.199.108.153, an address associated with GitHub’s global content‑delivery network. The domain appears on one external security blocklist and is actively blocked by the PhishDestroy service, confirming that at least one trusted anti‑phishing feed has identified malicious activity linked to the host. VirusTotal analysis shows that 11 of 91 scanning engines have raised detections, providing independent corroboration of the phishing classification.

The available metadata does not include a page title, SSL certificate details, HTTP response codes, or additional reputation scores, and the nameserver query returned no results, limiting the ability to assess DNS‑level controls. No public Open Threat Exchange (OTX) entries or other community‑sourced indicators have been observed for this subdomain. Because the domain is hosted on a shared GitHub Pages infrastructure, the underlying IP is not unique to the attacker, which can reduce the effectiveness of IP‑based blocking alone. Defenders should treat any traffic to ranvijayysinghrathore.github.io as malicious.

Immediate mitigation steps include adding the fully qualified domain name to web‑filter block lists, configuring email gateways to quarantine messages that reference the domain, and, where feasible, deploying URL‑reputation enforcement that incorporates the blocklist entry from PhishDestroy. Monitoring for new DNS records or changes to the underlying GitHub Pages site is advisable, as the attacker could modify content without altering the IP address. Given the elevated risk rating and the confirmed detections, continued observation and rapid response to any user reports involving the domain are recommended.