sakshi-gg[.]github[.]io

Analysis of sakshi-gg.github.io shows that the domain is hosted on GitHub Pages, a service that provides static site hosting under the github.io sub‑domain. DNS resolution points to the IP address 185.199.109.153, which belongs to the GitHub infrastructure and is shared among many legitimate pages. The site is currently listed on the PhishDestroy blocklist and has been flagged by 13 of 91 security vendors on VirusTotal, indicating a moderate level of consensus that the content is malicious. It also appears on a single additional security blocklist, reinforcing the suspicion of abusive use.

The available intelligence does not include a page title, HTTP response codes, SSL certificate details, or any specific brand impersonation. Consequently, the exact phishing vector (e.g., credential harvesting for a particular service) cannot be confirmed at this time. However, the combination of hosting on a free‑tier service, the presence on multiple reputable blocklists, and the VirusTotal detection count satisfies the criteria for an elevated‑risk generic phishing classification. Defenders should treat the domain as hostile.

Network perimeter controls ought to deny outbound connections to the resolved IP address 185.199.109.153 when the request originates from internal clients. Email security gateways and web proxies should enforce blocklisting of the full host name. Continuous monitoring of the domain for changes in detection scores or the appearance of new malicious indicators is recommended, as the underlying GitHub Pages site could be altered without notice. Incident response teams should also consider collecting forensic artifacts such as HTTP request headers and any payloads returned by the site for deeper malware analysis.