shubhamtiwari54[.]github[.]io

This domain, shubhamtiwari54.github.io, is flagged as a high-risk brand impersonation threat targeting Google. Analysis indicates the site is designed to deceive users into believing they are interacting with legitimate Google services, likely harvesting credentials or distributing malicious payloads under false pretenses. The campaign leverages social engineering tactics to exploit user trust in the targeted brand, increasing the likelihood of successful compromise. Infrastructure analysis reveals the domain is hosted on GitHub Pages infrastructure, registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, associated with AS54113 (Fastly, Inc.) in the United States. Security vendor detection on VirusTotal stands at 16 out of 95, indicating moderate consensus on its malicious nature. The domain appears on one security blocklist and is explicitly flagged by Google Safe Browsing as phishing. The SSL certificate is issued by Let's Encrypt (R12), a common practice among both legitimate and malicious sites to avoid browser warnings. As of the latest assessment, the domain remains active and unresolved by the hosting provider. Mitigation against this brand impersonation threat requires a multi-layered approach. Network-level protections should include blocking the domain and its resolving IP (185.199.108.153) at perimeter defenses, alongside monitoring for related indicators of compromise. Endpoint security measures should prioritize real-time phishing detection, particularly for pages mimicking Google login portals. User awareness training should emphasize verification of domain authenticity before entering credentials, especially for pages hosted on third-party platforms like GitHub Pages. Organizations are advised to implement strict domain validation policies and deploy brand monitoring tools to detect emerging impersonation attempts.