Phishing detection: accounts-google-login.github.io

Google
https://accounts-google-login.github.io/login/ Access site
Screenshot
Screenshot of accounts-google-login.github.io
Investigate
Domain accounts-google-login.github.io0 CT hosts on apex
URL https://accounts-google-login.github.io/login/
Phishunt analysis Beta
75 high suspicion likely_phishingheuristic risk score · not a probability
Why?
  • +6.1 Google Safe Browsing
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +3.9 Password field
  • +3.4 Cert reuse
  • +3.0 OpenPhish
  • +2.0 Young domain
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +0.8 Brand + login token
  • +0.6 Brand impersonation in path
  • +0.6 Long domain
  • +0.6 Login text in screenshot
  • +0.6 Script exfil endpoint
  • +0.6 Suspicious TLD
  • +0.4 Credential path
  • +0.3 Free CA
  • +0.2 Hyphens
  • +0.1 Deep subdomain
  • Boosted to 75: Credential exfil kit
25 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Fake Google account login page hosted on GitHub Pages via a combosquatting subdomain that incorporates Google account keywords. The Google brand appears entirely off the legitimate host. Confirmed malicious by Google Safe Browsing and OpenPhish. Likely harvests Google credentials.

Brand impersonation in pathBrand + login tokenPaaS host
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-08 · confidence 95%
Domain & Network
Whois
Network
Country United StatesUnited States
Hosting Fastly, Inc.
ASN AS54113
TLS Cert YR1
External detection Google Safe Browsing OpenPhish
GSB category: SOCIAL_ENGINEERING
CleanPhishTank · TweetFeed · urlscan.io
Report this phishing
PaaS platform GitHub Pages
Network / ASN Fastly, Inc.

Tracked from 2026-09-08 01:02 UTC  ·  Last refreshed 2026-09-12 15:30 UTC