suravisahu05-prog[.]github[.]io

This domain, suravisahu05-prog.github.io, is actively engaged in brand impersonation targeting Google users. Analysis indicates the site presents a fraudulent Google login interface designed to harvest user credentials, classified as a high-risk threat due to its active status and confirmed malicious intent. The page title, however, displays 'Amazon,' suggesting potential obfuscation or dual-purpose exploitation tactics. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to the IP address 185.199.108.153, located within the United States under AS54113 (Fastly, Inc.). The domain is flagged by 7 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as a phishing threat. It appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Let's Encrypt (R12), a common but not exclusive indicator of legitimate domains, which may be leveraged to evade basic security checks. As of the latest verification, suravisahu05-prog.github.io remains active and continues to pose a significant risk to users. Organizations and individuals are advised to implement immediate blocking of the domain and its associated IP address (185.199.108.153) at the network perimeter. Endpoint protection systems should be updated to include this domain in their deny lists, and users should be educated on recognizing brand impersonation tactics, particularly those mimicking Google authentication pages. Monitoring for credential reuse or unauthorized access attempts linked to this domain is strongly recommended.