habeeiiyy[.]github[.]io

This domain, habeeiiyy.github.io, is identified as a high-risk phishing site specializing in brand impersonation targeting Google. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with legitimate Google services, likely harvesting credentials or distributing malicious payloads. The domain leverages GitHub Pages for hosting, a common tactic to exploit trusted platforms for phishing operations. Infrastructure analysis reveals the domain resolves to the IP address 185.199.108.153, geolocated in the United States under AS54113 (Fastly, Inc.). The domain is registered through GitHub, Inc., and was flagged by Google Safe Browsing as a phishing threat. Detection metrics from VirusTotal indicate 11 out of 95 security vendors have classified this domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Let's Encrypt (YR2), a detail often exploited to lend false legitimacy to phishing sites. As of the latest assessment, habeeiiyy.github.io remains active and continues to pose a significant risk to users. The domain has not been taken down by the hosting provider, and no remediation actions have been observed. Organizations and individuals are advised to block this domain at the network level and implement browser-based protections to mitigate exposure. Given the persistent nature of such threats, continuous monitoring of related infrastructure is recommended to identify and neutralize emerging variants.