shubham25b01010593[.]github[.]io

Analysis of the domain shubham25b01010593.github.io indicates active brand impersonation targeting Apple, despite the page title displaying 'NETFLIX-Homepage.' The domain, registered on February 21, 2026, through MarkMonitor, Inc., resolves to IP address 185.199.108.153, a known GitHub Pages infrastructure endpoint. Infrastructure analysis reveals the use of Varnish, GitHub Pages, HSTS, and Fastly technologies, alongside a Let's Encrypt SSL certificate, which is consistent with legitimate and malicious sites alike. As of July 12, 2026, the domain remains active and is flagged by Google Safe Browsing for 'SOCIAL_ENGINEERING.' It appears on one security blocklist, and 19 out of 95 security vendors on VirusTotal have detected it as malicious. The discrepancy between the declared brand target (Apple) and the observed page title (Netflix) suggests either a misconfiguration, an attempt to mislead automated detection systems, or a multi-brand phishing operation. The exact content and functionality of the site have not yet been analyzed, so the precise phishing mechanism remains unconfirmed. Defenders should treat this domain as high-risk due to its active status, brand impersonation classification, and detection by multiple security vendors. Blocking access to the domain and its resolving IP (185.199.108.153) is recommended. Further investigation into the site's payload, redirect chains, and associated infrastructure is advised to determine the full scope of the threat.