aniketsangal[.]github[.]io

This domain, aniketsangal.github.io, is flagged for high-risk brand impersonation targeting Apple. Analysis indicates the threat type involves credential harvesting through a fraudulent page masquerading as Netflix India, despite its primary target being Apple ID logins. The page title, 'Netflix India - Watch Shows online, Watch movies online,' misaligns with the intended brand impersonation, suggesting either a misconfiguration or an attempt to evade detection by blending with legitimate streaming services. Infrastructure analysis reveals the domain was created on March 8, 2013, and is registered through GitHub, Inc. It resolves to the IP address 185.199.111.153, hosted under AS54113 (Fastly, Inc.) in the United States. Detection metrics show 19 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common attribute in both legitimate and malicious domains. No Google Safe Browsing (GSB) detections are currently recorded. As of the latest assessment, aniketsangal.github.io remains active and is blocked by at least one security filter. The domain's persistence on GitHub's infrastructure, despite its malicious use, highlights the challenges in mitigating abuse of legitimate hosting services. Users are advised to verify domain authenticity before entering credentials, particularly on pages requesting Apple ID information. Organizations should monitor for similar impersonation patterns, such as mismatched page titles and brand targets, to preemptively block credential theft attempts.