markin[.]github[.]io

This domain is flagged as a high-risk phishing resource specializing in brand impersonation targeting Google. The site mimics Google’s authentication portal, presenting a fraudulent login interface under the page title 'Sign in - Google Accounts' to deceive users into disclosing credentials. Analysis indicates the domain is hosted on GitHub Pages and resolves to the IP address 185.199.109.153. Security vendor detections on VirusTotal report 20 out of 95 engines flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and is actively blocked by Google Safe Browsing for phishing. The SSL certificate is issued by Let’s Encrypt (R12), a common tactic to lend superficial legitimacy to fraudulent sites. Infrastructure analysis reveals no legitimate association with Google’s official domains or services. Mitigation requires immediate blocking of the domain and its resolving IP across network security controls. Security teams should deploy indicators of compromise (IOCs) including the domain, IP, and SSL certificate fingerprint in endpoint detection and response (EDR) systems. User awareness training should emphasize verifying the authenticity of login portals, particularly those hosted on third-party platforms like GitHub Pages. Credential monitoring and multi-factor authentication (MFA) enforcement are recommended to mitigate potential account takeovers resulting from this phishing campaign.