harshavardhan3535[.]github[.]io

This domain, harshavardhan3535.github.io, is actively engaged in brand impersonation targeting Google. Analysis indicates the site mimics legitimate Google services, likely to harvest user credentials or distribute malicious payloads. No explicit crypto drainer kit signatures were identified, but the domain exhibits characteristics consistent with credential phishing and social engineering campaigns. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to IP address 185.199.108.153 (AS54113, Fastly, Inc., US). Security vendor detection on VirusTotal stands at 14/95, with Google Safe Browsing explicitly flagging the domain as phishing. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, and no historical registration data is publicly available due to its GitHub Pages origin. Current status remains active, with no takedown or mitigation observed as of analysis. Response actions should include immediate blocking of the domain and its resolving IP at network perimeters. Organizations are advised to monitor for related GitHub Pages subdomains, as threat actors frequently rotate these for phishing campaigns. Remaining risk is classified as high due to the domain's active status, brand impersonation tactics, and confirmed detection by multiple security mechanisms. Users should be alerted to verify domain authenticity before interacting with any Google-branded login portals.