mussa-esliman[.]github[.]io

This domain, mussa-esliman.github.io, is flagged as an active brand impersonation threat targeting Apple. Analysis indicates the site mimics Apple’s official branding and design, likely to deceive users into submitting credentials or financial information. The page title, 'Apple Responsive Replica,' further confirms the intent to replicate Apple’s legitimate interface, a common tactic in credential theft and fraud campaigns. No evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting operations. Infrastructure analysis reveals the domain resolves to the IP address 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. The domain is registered through GitHub, Inc., and utilizes an SSL certificate issued by Let’s Encrypt (YR2). Security vendor assessments on VirusTotal show 12 out of 95 detections, indicating a moderate-to-high confidence level in its malicious nature. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. No creation date was provided, but the use of GitHub Pages suggests recent deployment, as such services are frequently abused for short-lived phishing campaigns. Current status confirms the domain remains active, posing an ongoing risk to users. Response actions should include immediate blacklisting by network security controls, DNS sinkholing, and browser-based blocking to prevent access. Users who may have interacted with the domain are advised to reset credentials, enable multi-factor authentication, and monitor accounts for unauthorized activity. Despite mitigation efforts, the risk persists due to the domain’s continued operation and the potential for rapid redeployment under a new identifier. Organizations should prioritize awareness training to recognize brand impersonation tactics and verify domain authenticity before entering sensitive information.