sangramsingh0175[.]github[.]io

The domain sangramsingh0175.github.io is currently active and classified as a generic phishing threat with a high-risk assessment. Analysis indicates this infrastructure is leveraging GitHub Pages to host deceptive content aimed at harvesting user credentials or distributing malicious payloads. While the page currently displays a 'Site not found' message, the underlying domain remains operational and flagged for phishing activity, suggesting either a dormant phase or a cloaking mechanism to evade detection. Infrastructure analysis reveals the domain resolves to the IP address 185.199.108.153, associated with GitHub, Inc., and is registered through the same provider. Detection metrics show 9 of 95 security vendors on VirusTotal have flagged this domain as malicious, with an additional presence on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common but not inherently trustworthy certificate authority often exploited in phishing campaigns. The domain's reliance on GitHub's legitimate hosting service complicates detection, as it blends with benign traffic while maintaining a facade of legitimacy. Current status confirms the domain remains active, posing an ongoing risk to users who may encounter it through phishing links in emails, social media, or malicious advertisements. Recommendations include blocking the domain at the network level, updating endpoint protection signatures to include the IP address 185.199.108.153, and educating users to scrutinize GitHub Pages URLs for irregularities. Organizations should monitor for connections to this infrastructure and investigate any prior interactions, as the domain may have been used in targeted campaigns prior to its current dormant state.