godisgreat1000x-hub[.]github[.]io

The domain godisgreat1000x-hub.github.io is actively engaged in brand impersonation, specifically targeting Microsoft with a fraudulent login portal. This domain presents a high-risk threat designed to harvest user credentials by mimicking legitimate Microsoft authentication pages. The page title, 'Sign in to your account,' closely resembles official Microsoft login interfaces, increasing the likelihood of successful deception. Analysis indicates this domain has been flagged by 7 of 95 security vendors on VirusTotal, a notable detection rate that underscores its malicious nature. Infrastructure analysis reveals the domain is registered through GitHub, Inc., and resolves to the IPv6 address 2606:50c0:8001::153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist, and its GitHub Pages origin suggests potential abuse of free hosting services to evade takedown efforts. Current status confirms the domain remains active, posing an ongoing threat to users. Organizations and individuals are advised to block this domain at the network level and implement email filtering rules to prevent delivery of messages containing this URL. Users should be educated to verify domain authenticity before entering credentials, particularly when prompted by unsolicited login requests. Monitoring for similar GitHub-hosted domains impersonating trusted brands is recommended, as this tactic is frequently reused by threat actors.