shaksham-ml[.]github[.]io

The domain shaksham-ml.github.io was created on June 25, 2026 and is hosted on GitHub Pages, resolving to the IP address 185.199.109.153. The IP belongs to the Fastly network (AS54113) and is geolocated in the United States. The site presents a TLS certificate issued by Let’s Encrypt (YR2) and the underlying stack includes Varnish, GitHub Pages, and Fastly services. Analysis of the page title returned by the host indicates a direct reference to the streaming service Netflix, matching the declared brand‑impersonation threat type.

VirusTotal scans show a single detection out of 91 security vendors, and the domain appears on one public blocklist, with PhishDestroy confirming it as blocked. The Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. An HTTP request to the site yields a 404 status, suggesting the page is no longer serving content or has been removed. The registrar information lists GitHub, Inc. as the registrant, consistent with the use of GitHub Pages.

While the limited visibility of the landing page prevents confirmation of any credential‑stealing forms or additional malicious payloads, the combination of a brand‑specific page title, low trust score, detection by multiple vendors, and blocklist presence supports a classification of an elevated‑risk brand‑impersonation campaign targeting Netflix users. Defenders should continue to block the IP 185.199.109.153 at network perimeters, add shaksham-ml.github.io to URL filtering and threat intelligence feeds, and monitor GitHub Pages for other similarly created subdomains. Ongoing observation of any changes to the HTTP response or additional detections is recommended to gauge activity resurgence.