anshshri04[.]github[.]io

The domain anshshri04.github.io is currently flagged as a high-risk generic phishing site specializing in credential harvesting, with specific targeting of GitHub user accounts. Analysis confirms the domain remains active and operational, presenting a persistent threat to users who may encounter it through deceptive links in emails, messages, or compromised websites. No legitimate GitHub branding or official repository content is hosted at this location, despite its use of GitHub Pages infrastructure. Infrastructure analysis reveals the domain was registered through GitHub, Inc. on April 28, 2026, with an anomalous future creation date suggesting potential manipulation of registration records. It resolves to the IP address 185.199.108.153, a known GitHub Pages hosting endpoint, and is secured with a Let's Encrypt R12 SSL certificate. Security vendor detections show 12 of 95 engines on VirusTotal flagging the domain as malicious, while it appears on one additional security blocklist. The page currently displays a 'Site not found' error, which may indicate either a temporary placeholder or an attempt to evade detection while maintaining the domain in an active state. Current risk assessment classifies this domain as high severity due to its active status, confirmed malicious detections, and use of trusted hosting infrastructure to lend credibility. Organizations and users are advised to implement immediate network-level blocking of anshshri04.github.io at firewalls and DNS resolvers. Security teams should monitor for any references to this domain in logs or endpoint telemetry, particularly in conjunction with GitHub-related authentication events. Users who may have interacted with this domain should initiate password resets for their GitHub accounts and enable multi-factor authentication if not already active. The anomalous 2026 creation date warrants further investigation into potential registrar manipulation or domain registration system abuse.