delivery-globaldhlauth[.]github[.]io

The domain delivery-globaldhlauth.github.io is currently flagged as an active delivery‑scam infrastructure with an elevated risk rating. Infrastructure analysis shows the domain is hosted on GitHub Pages, indicated by its registration through the GitHub Pages service and by resolution to the IP address 185.199.109.153, which is owned by GitHub’s content‑delivery network. The domain appears on one external security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least some defensive platforms have identified it as malicious.

VirusTotal reports that 15 out of 91 scanning engines have generated detections for the domain, providing additional independent confirmation of its malicious nature. No public page title, SSL certificate details, or specific brand impersonation have been disclosed in the available intelligence, leaving the exact content and targeted brand unknown. Defenders should prioritize immediate mitigation by adding delivery-globaldhlauth.github.io to URL filtering and DNS blocklists, especially for environments that enforce strict outbound web controls.

Network monitoring should include alerts for DNS queries to the IP 185.199.109.153 and any HTTP(S) traffic directed at the GitHub Pages host that could be leveraged for credential harvesting or malicious payload delivery. Given the elevated risk level, security teams are advised to share this indicator of compromise with threat‑intel sharing platforms and to monitor for similarly structured GitHub Pages subdomains that may appear in future campaigns. Continuous re‑evaluation is recommended as additional analysis of the site’s content becomes available.