truonghoanglien2007-spec[.]github[.]io

This domain is flagged as a high-risk credential harvesting phishing site, designed to deceive users into submitting sensitive login credentials. Analysis indicates the threat is actively targeting individuals through fraudulent login portals, likely mimicking legitimate services to capture usernames, passwords, and other authentication details. The domain remains operational, posing an ongoing risk to unsuspecting visitors. Infrastructure analysis reveals the domain truonghoanglien2007-spec.github.io is registered through GitHub, Inc., and resolves to the IP address 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Security vendor detections on VirusTotal report 14 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The domain leverages GitHub Pages infrastructure, which is frequently abused for phishing due to its free hosting and reputable domain association. Mitigation against credential harvesting phishing requires immediate action from both end users and network administrators. Users should avoid interacting with the domain and refrain from entering any credentials on pages hosted under truonghoanglien2007-spec.github.io. Network-level protections should include blocking the IP address 185.199.109.153 and implementing DNS-based filtering to prevent resolution of the domain. Organizations are advised to monitor for credential reuse attempts and enforce multi-factor authentication to mitigate the impact of stolen credentials. Security teams should review logs for connections to the domain or IP and conduct phishing awareness training to reduce susceptibility to similar threats.