nishan-rai[.]github[.]io

Analysis of nishan-rai.github.io, reported on 2026-07-29, identifies the domain as an active generic phishing infrastructure. The domain is registered through GitHub, Inc., indicating use of the GitHub Pages service for hosting. DNS resolution returns the IPv4 address 185.199.109.153, which belongs to the GitHub Pages network, confirming that the content is served from GitHub’s infrastructure. A nameserver query returns no records (NS_NOT_FOUND), suggesting that the domain relies on default GitHub name resolution rather than custom authoritative servers.

VirusTotal has evaluated the domain with 91 security vendors; 14 of those vendors have raised detections, reflecting a measurable level of malicious classification across multiple scanning engines. The domain is listed on a single external security blocklist and is actively blocked by the PhishDestroy platform, indicating that at least one dedicated anti‑phishing service has incorporated it into its mitigation set. Google Safe Browsing also flags the domain for social engineering, which aligns with the generic phishing designation. The available evidence confirms that the domain is currently active and being used for malicious purposes, but the specific payload, target brand, or page content has not been publicly disclosed.

Consequently, the precise phishing vector and victim interaction flow remain uncertain. Defenders should prioritize blocking the domain at network perimeter devices, updating DNS‑based blocklists, and ensuring that endpoint protection solutions incorporate the VirusTotal detection data. Continuous monitoring of the IP address 185.199.109.153 for any additional malicious domains hosted on the same GitHub Pages infrastructure is advisable, as shared hosting environments can facilitate rapid redeployment of phishing sites. Organizations should also consider reporting any observed malicious activity to the hosting provider and relevant takedown services to accelerate remediation.