cdnvldeyco[.]github[.]io

Analysis of cdnvldeyco.github.io confirms it as an active phishing endpoint hosted on GitHub Pages infrastructure. The domain, registered through GitHub, Inc., resolves to 185.199.108.153, an IP address associated with GitHub's content delivery network. As of July 20, 2026, the domain remains operational despite being flagged by two security blocklists: PhishDestroy and OpenPhish. VirusTotal telemetry indicates that 4 out of 95 security vendors classify this domain as malicious, though the specific payload or phishing kit in use has not been publicly detailed. Infrastructure review reveals the domain lacks configured nameservers (NS_NOT_FOUND), a common characteristic of ephemeral phishing pages deployed on free hosting services. The absence of nameserver records suggests the attacker may be leveraging GitHub's default DNS resolution, reducing the domain's detectability via traditional DNS-based defenses. No brand impersonation or scam category has been confirmed in available intelligence; the exact content of the phishing page remains unanalyzed. Defenders should prioritize blocking this domain at the network level, particularly in environments where GitHub Pages traffic is permitted. Given the domain's persistence on a legitimate hosting provider, monitoring for additional subdomains or rapid re-deployment under new GitHub Pages URLs is recommended. Security teams should correlate logs for connections to 185.199.108.153 and review GitHub Pages activity for unauthorized deployments. No takedown request has been observed as of the report date, and the domain continues to serve content.