khordvn2222-wq[.]github[.]io

The domain khordvn2222-wq.github.io is currently listed as an active generic phishing site with an elevated risk rating. Infrastructure analysis shows that the domain is hosted on GitHub Pages, a service that provides free static‑site hosting, and resolves to the IP address 185.199.109.153, which is owned by GitHub’s content delivery network. Registration data confirms the use of the GitHub Pages registrar, indicating that the domain was likely created to exploit the trust associated with GitHub’s infrastructure.

Threat intelligence sources place the domain on two security blocklists. Specifically, it is blocked by PhishDestroy and OpenPhish, both of which specialize in phishing detection. VirusTotal reports that eight of ninety‑one security vendors have flagged the domain, reinforcing the suspicion of malicious activity. No additional contextual information such as page title, target brand, or observed payloads has been released, leaving the exact phishing content and intended victim profile undefined.

Defenders should treat any traffic to khordvn2222-wq.github.io as malicious. Recommended actions include adding the domain to deny‑list rules in firewall and proxy configurations, monitoring DNS queries for the associated IP address, and ensuring that endpoint protection solutions receive the latest indicator updates from the blocklists that have already identified the domain. Continuous observation of GitHub Pages‑hosted domains is advised, given the platform’s legitimate use case and potential for abuse.