googles-lab[.]github[.]io

Analysis of googles-lab.github.io indicates that the domain is actively being used for a generic phishing campaign. The domain is registered through GitHub, Inc., and authoritative nameserver records were not found in the available data, limiting direct DNS attribution. Infrastructure resolution points to the IP address 185.199.108.153, which belongs to GitHub Pages hosting. The domain appears on two security blocklists and is listed as blocked by PhishDestroy and OpenPhish, confirming its malicious classification.

VirusTotal scans show that 10 of 91 antivirus and URL‑scanning engines have flagged the domain, providing additional corroboration of phishing activity. The current status is reported as active, and no evidence of mitigation or takedown has been observed. The absence of publicly visible nameserver records hampers attribution of DNS control, but the registration through GitHub suggests the domain leverages the platform’s free hosting service. Because the IP is shared among many unrelated GitHub Pages sites, other domains on the same address may be benign, yet the association with known phishing blocklists justifies treating the entire IP as suspicious for this specific host.

Uncertainty remains regarding the exact phishing payload, target brand, or page content, as no page title or content analysis is available, and details such as SSL certificates or HTTP response codes have not been disclosed. Defenders should block outbound and inbound traffic to 185.199.108.153 when the host name googles-lab.github.io is present, incorporate the domain into email and web filtering policies, and monitor blocklist and VirusTotal updates for any changes. Reviewing internal DNS and proxy logs for queries to this host, isolating potentially affected workstations, and initiating user notifications with credential reset procedures if compromise is suspected are recommended actions to mitigate risk.