raj-hans-hub[.]github[.]io

This domain, raj-hans-hub.github.io, is actively hosting a phishing page designed to impersonate a legitimate document-sharing portal. Analysis indicates the page employs social engineering tactics to deceive users into submitting sensitive credentials, such as login details or personal information, under the guise of accessing a document. The threat is classified as generic phishing with a high-risk level due to its active status and targeted deception methods. Infrastructure analysis reveals the domain is registered through GitHub, Inc., resolving to the IP address 185.199.111.153, which is geolocated in the US under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common but not exclusive indicator of legitimacy. The domain is flagged by 8 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The page title, 'Document,' further suggests an attempt to mimic generic file-sharing services, increasing the likelihood of successful phishing attempts. Users who have visited raj-hans-hub.github.io should immediately cease all interaction with the domain. If credentials or sensitive information were entered, affected parties must change passwords for all associated accounts, prioritizing those with financial or administrative privileges. Enable multi-factor authentication where available to mitigate further risk. Monitor accounts for unauthorized activity and report any suspicious transactions or access attempts. Network administrators should block the domain and its resolving IP (185.199.111.153) at the perimeter to prevent additional exposure. Given the domain's active status, continuous monitoring for related indicators of compromise is recommended.