tobtipu-wq[.]github[.]io

tobtipu-wq.github.io is currently listed as an active high‑risk generic phishing site. The domain is hosted on GitHub Pages and was registered through GitHub, Inc., which means the registrar information points to a reputable service but does not preclude abuse. DNS resolution returns the IPv4 address 185.199.108.153, the standard address for GitHub‑hosted content, and no custom nameserver records are visible (NS_NOT_FOUND). The site has been added to the PhishDestroy blocklist and appears on one additional security blocklist, indicating that at least two independent feeds have observed malicious activity. Google Safe Browsing marks the URL with a social‑engineering warning, and VirusTotal reports that 14 out of 91 scanned security engines have flagged the domain as malicious.

The exact detection signatures are not disclosed, but the consensus among multiple vendors suggests the presence of phishing‑related payloads or URLs. Because the domain leverages GitHub’s infrastructure, traditional takedown mechanisms may be slower, and the content can be quickly regenerated under a different repository name. Open items remain: no public page title or content analysis has been released, so the specific targeting vector cannot be confirmed. No SSL certificate details beyond GitHub’s default HTTPS are available, and no information on the underlying phishing kit or brand impersonated has been disclosed.

Consequently, defenders should treat any traffic to tobtipu-wq.github.io as suspicious. Recommendations include adding the domain to local block lists, configuring web proxies to block or intercept requests, and monitoring DNS queries for the resolved IP address. Security teams should also consider sharing any additional observations with broader threat‑intel communities to accelerate takedown efforts. Continuous re‑evaluation is advised, as the domain’s status may change if the hosting account is suspended or the content is altered.