blowfishxyz[.]github[.]io

The domain blowfishxyz.github.io is classified as a high-risk brand impersonation threat. This domain mimics the legitimate Blowfish brand, potentially leading users to believe they are interacting with an official source. The threat is active and poses a significant risk to users who may be targeted for credential theft or other malicious activities.

Infrastructure analysis reveals that the domain was created on May 12, 2026, and is registered through GitHub Pages. It resolves to the IP address 185.199.111.153, which is located in the United States and is associated with GitHub, Inc. The domain is flagged by 10 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. Additionally, the domain appears on 3 security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. The Google Safe Browsing service has also flagged this domain as a phishing threat. The SSL certificate is issued by Let's Encrypt, which is a common practice for legitimate and malicious sites alike.

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the URL and SSL certificate of any site claiming to be Blowfish before providing any sensitive information. Security teams should monitor and block this domain at the network level to prevent access. Organizations should also educate their users about the dangers of brand impersonation and encourage them to report any suspicious activities to the security team for further investigation.