juanhz16[.]github[.]io

On August 01, 2026 the domain juanhz16.github.io was identified as an active generic phishing infrastructure. Technical resolution shows the domain points to the IP address 185.199.108.153, a host commonly associated with GitHub Pages services. Registration data indicates the domain was created through GitHub, Inc., which provides the underlying hosting platform but does not imply endorsement of malicious activity. Google Safe Browsing has flagged the URL for social engineering, and two independent phishing feed providers, PhishDestroy and OpenPhish, list the domain as blocked.

In addition, the domain appears on two broader security blocklists, reinforcing its reputation as a malicious resource. VirusTotal analysis reports that nine of ninety‑one scanned security vendors flagged the domain, demonstrating a modest but notable detection rate across multiple engines. No nameserver information is available, as the query returned NS_NOT_FOUND. The current operational status remains active, suggesting the site continues to host or redirect to phishing content.

While the exact page title, targeted brand, or malicious payload have not been publicly disclosed, the convergence of hosting, detection, and blocklist signals warrants immediate defensive action. Organizations should incorporate the domain and its hosting IP into URL filtering and DNS sinkhole rules, monitor outbound traffic for connections to the IP address, and leverage threat‑intelligence feeds that reference PhishDestroy, OpenPhish, and Google Safe Browsing alerts. Continuous re‑evaluation is recommended to capture any changes in the site’s content or hosting configuration.