shivam1456[.]github[.]io

This domain, shivam1456.github.io, is flagged as a high-risk credential-harvesting phishing operation specifically targeting users of the Airbnb booking platform. Analysis indicates the site replicates the legitimate Airbnb interface, including the page title 'Holiday Homes & Apartment Rentals - Airbnb,' to deceive victims into submitting login credentials, payment details, or personal information. No explicit drainer kit signatures have been identified, though the infrastructure suggests a lightweight, static phishing page hosted on a public repository service. Infrastructure analysis reveals the following technical indicators: the domain is registered through GitHub, Inc., and resolves to the IPv6 address 2606:50c0:8002::153, hosted on AS54113 (Fastly, Inc.) with a US-based geolocation. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Detection metrics include a VirusTotal score of 5/95 security vendors flagging the domain, while it appears on one security blocklist, specifically PhishDestroy. No Google Safe Browsing (GSB) hits were reported at the time of assessment, indicating potential gaps in automated detection coverage. The domain remains active and continues to pose a significant risk to users. Response actions should include immediate blacklisting by security providers, takedown requests to the hosting provider (GitHub Pages), and public disclosure to prevent further victimization. Despite its current detection by a limited number of vendors, the site's low-complexity infrastructure and reliance on a trusted hosting service may allow it to evade broader detection temporarily. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on booking platforms, and report suspicious URLs to their security teams or threat intelligence feeds for further analysis.