marshaneare[.]github[.]io

Analysis conducted on July 23, 2026 identifies marshaneare[.]github[.]io as a brand‑impersonation domain targeting Google accounts. The site resolves to the IPv4 address 185.199.110.153, which is hosted within the Fastly, Inc. network (AS54113) in the United States. The domain’s DNS configuration lists four authoritative name servers: dns1.p05.nsone.net, dns2.p05.nsone.net, dns3.p05.nsone.net, and ns-1622.awsdns-10.co.uk. The registration record shows the domain was created on March 08, 2013 and was obtained through GitHub, Inc., indicating use of the GitHub Pages service.

Observed technologies include Varnish, GitHub Pages, and Fastly, and the site presents a valid Let’s Encrypt certificate (R12). The page title returned by the server is "Sign in - Google Accounts", yet the HTTP response code is 404, suggesting the landing page is no longer accessible. The domain has been listed on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans report fifteen of ninety‑three security vendors flagging the domain as malicious.

Current status is offline, confirming that the phishing infrastructure has been taken down. Defenders should continue to monitor the associated IP address and the Fastly CDN for any re‑use, enforce URL filtering for the full domain, and update intrusion‑prevention signatures to include the observed host‑header and certificate fingerprint. Because the site is no longer reachable, remediation focuses on preventing future re‑deployment of similar GitHub‑Pages‑based impersonation campaigns and ensuring that user‑education campaigns reference the exact page title and domain observed in this case.