sovereignx001[.]github[.]io

This domain, sovereignx001.github.io, is an active phishing site hosted on GitHub Pages infrastructure as of July 24, 2026. Analysis indicates the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, a known GitHub Pages hosting endpoint. The domain currently lacks configured nameservers, which may suggest misconfiguration or an attempt to evade detection. It appears on two security blocklists and is actively blocked by PhishDestroy and OpenPhish, reinforcing its classification as a high-risk threat.

Seven of ninety-one security vendors on VirusTotal flag this domain, though the exact nature of the phishing content remains unconfirmed due to the absence of detailed page analysis. Infrastructure analysis reveals the domain leverages GitHub's legitimate hosting service, a common tactic to blend malicious activity with trusted cloud providers. The lack of nameserver records does not prevent resolution, as GitHub Pages relies on its own DNS infrastructure. Defenders should note that while GitHub Pages is a legitimate service, this domain's presence on multiple blocklists and detection by security vendors warrant immediate action.

The exact brand or service being impersonated is not specified in available data, and no phishing kit or specific scam type has been identified. Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to the IP 185.199.108.153, and reviewing logs for any interactions with sovereignx001.github.io. Organizations using GitHub Pages for legitimate purposes should ensure their security controls can distinguish between trusted and untrusted repositories. Given the domain's active status and blocklist presence, defenders should treat it as malicious until further analysis confirms otherwise.