gooogleqgmailcom-a11y[.]github[.]io

Analysis of domain gooogleqgmailcom-a11y.github.io confirms active credential phishing operations targeting email login credentials. The domain name employs a homograph attack using multiple visually similar characters to impersonate legitimate Google services, specifically targeting users expecting a Google Gmail interface. No known drainer kit or advanced JavaScript toolkit has been identified in available sandbox analysis; the page appears to rely on basic HTML forms to capture input data. The infrastructure lacks advanced obfuscation, which may indicate early-stage deployment or low-resource threat operation. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.108.153, which is associated with GitHub Pages hosting services. VirusTotal scanning shows 0 detections out of 95 engines as of the most recent analysis, indicating no current signature-based detection. Registration data is obscured via GitHub Pages, and granular creation date remains unavailable due to privacy settings. Google Safe Browsing (GSB) status is unconfirmed due to limited public telemetry; however, no public blocklist inclusion has been observed. Additional reconnaissance indicates this IP range (185.199.108.0/22) is commonly leveraged for legitimate GitHub Pages deployments, complicating immediate takedown via IP-based blocking. The domain remains active as of the latest scan, with sustained accessibility and no observed disruption. Response actions require coordinated takedown via GitHub Abuse Report using the seed identifier a44a48, citing violation of GitHub Pages acceptable use policies. Users accessing this domain risk exposure of email credentials and potential follow-on account compromise. Remaining risk is classified as high due to the domain’s active status, lack of detection coverage, and effective mimicry of a widely trusted brand. Immediate precaution includes user awareness campaigns and network-level blocking of the IP 185.199.108.153 until infrastructure neutralization is confirmed.