quoctuan-8386[.]github[.]io

The domain quoctuan-8386.github.io is currently flagged as a high‑risk phishing host. The domain resolves to the IP address 185.199.108.153, which belongs to the GitHub Pages hosting infrastructure. Registration data indicates the domain was created through GitHub, Inc., confirming that the sub‑domain is allocated under the public‑facing GitHub Pages service. Reputation services have taken notice: PhishDestroy has listed the domain as blocked, and at least one external security blocklist also contains the entry. VirusTotal scans have resulted in four of ninety‑five antivirus engines marking the domain as malicious, providing additional corroboration of hostile intent. The domain’s authoritative name server information could not be retrieved, as the “Nameservers” field returned NS_NOT_FOUND, limiting the ability to perform a deeper DNS‑based attribution. No additional context such as page title, brand targeting, or specific phishing kit has been disclosed, so the precise payload or credential‑harvesting technique remains unknown. Defenders should block traffic to the domain at the network perimeter and add the IP address 185.199.108.153 to host‑based deny lists. Continuous monitoring of the domain’s resolution and any future VirusTotal or blocklist updates is advised to capture changes in malicious activity. Awareness of the GitHub Pages hosting environment is important, as compromised or abused GitHub repositories can serve as convenient drop‑off points for phishing campaigns. Organizations should also educate users about unsolicited links that resolve to GitHub sub‑domains, especially when the URL includes unrelated strings such as “quoctuan-8386”. Until further analysis of the hosted content is possible, treating the domain as malicious and preventing any credential submission to it is the safest mitigation.