vishalrawat5.github.io: Active GitHub Pages Phishing Endpoint

This domain, vishalrawat5.github.io, is identified as an active phishing endpoint leveraging GitHub Pages infrastructure to distribute credential-harvesting content. Analysis indicates the site employs generic phishing techniques, likely mimicking legitimate login portals to capture user credentials or financial information. Despite displaying a 'Site not found' title, forensic evidence confirms the presence of malicious payloads, suggesting a cloaking mechanism or incomplete deployment at the time of inspection. Infrastructure analysis reveals the domain resolves to the IP address 185.199.108.153, registered under GitHub, Inc., with an SSL certificate issued by Let's Encrypt (R12). The domain was created on May 08, 2026, though this appears to be a placeholder or erroneous entry, as GitHub Pages domains are typically subdomains of github.io and do not follow traditional registration timelines. Detection metrics show 12 out of 95 security vendors flagging the domain on VirusTotal, while it appears on one security blocklist. Google Safe Browsing (GSB) status is not explicitly listed, but the presence on PhishDestroy’s blocklist corroborates its malicious classification. As of the latest assessment, vishalrawat5.github.io remains active, posing a high risk to users who may encounter it through phishing links distributed via email, social media, or malicious advertisements. The use of GitHub Pages infrastructure complicates takedown efforts due to the platform’s legitimate hosting of static content. Users are advised to avoid interacting with the domain, and network administrators should implement blocking rules for the IP 185.199.108.153 and associated subdomains. Continuous monitoring is recommended, as threat actors frequently rotate domains and IPs to evade detection.