hoangnguyen275[.]github[.]io

hoangnguyen275.github.io is an active GitHub Pages site that has been classified as a generic phishing infrastructure. The domain resolves to 185.199.109.153, an IP address owned by GitHub’s global content‑delivery network, confirming that the hosting service is the public static site platform. VirusTotal analysis reports that 16 of 91 security vendors have flagged the domain as malicious, providing a modest but notable consensus of suspicion. The domain is listed on a single external blocklist and is explicitly blocked by the PhishDestroy filtering service, reinforcing its detection by community‑driven defenses. The threat intelligence record assigns an elevated risk level, reflecting the combination of vendor detections and active blocklist presence.

Publicly available data does not include a page title, SSL certificate details, HTTP status codes, or any observed credential‑capture page content, leaving the exact phishing lure and targeted brand unspecified. No information is available regarding the presence of known phishing kits or additional hosting infrastructure beyond the GitHub Pages service. Consequently, analysts cannot confirm whether the site hosts a fully functional credential‑harvesting form or serves only as a redirect.

Defenders should treat the domain as hostile. Immediate mitigation steps include adding hoangnguyen275.github.io to DNS‑based deny lists, configuring web‑proxy or secure‑web‑gateway policies to block HTTP requests to the domain, and ensuring that endpoint protection solutions are updated to reflect the 16 vendor detections reported by VirusTotal. Continuous monitoring of the IP address 185.199.109.153 for new subdomains or similar GitHub‑Pages‑based phishing campaigns is advised, as adversaries frequently reuse this infrastructure.