rong1209[.]github[.]io

This domain, rong1209.github.io, is identified as a high-risk phishing endpoint designed to harvest user credentials through fake login portals. Analysis indicates the page mimics legitimate authentication flows, likely targeting unsuspecting users attempting to access cloud services or social media platforms. No explicit brand impersonation or crypto drainer kit signatures were observed, but the generic phishing framework remains highly effective for credential theft. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to IP address 185.199.108.153. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. VirusTotal detection metrics show 9 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The domain remains active as of the latest verification, with no evidence of takedown or sinkholing. GitHub, Inc. serves as the registrar, though no creation date is publicly available for this GitHub Pages subdomain. Current status confirms the domain is still operational, with no observed disruption in service. Response actions should include immediate blacklisting of the domain and IP across enterprise security controls, alongside monitoring for credential reuse from affected users. The remaining risk is classified as high due to the domain's active status and low detection coverage on blocklists. Organizations are advised to implement DNS filtering and endpoint protection rules to prevent access, while users should be alerted to avoid entering credentials on untrusted login pages.