cantiknyaaa59-gif[.]github[.]io

On July 29, 2026 analysts observed that the domain cantiknyaaa59-gif.github.io is actively used for a generic phishing campaign and is classified with an elevated risk level. Infrastructure analysis shows the domain resolves to the IP address 185.199.108.153, which belongs to GitHub Pages hosting. Registration information confirms the domain was created through GitHub, Inc., indicating that the attacker leveraged a legitimate registrar to obtain a free sub‑domain.

No nameserver records were returned (NS_NOT_FOUND), suggesting the domain relies on default GitHub DNS configuration. Threat intelligence feeds report that the domain is blocked by the PhishDestroy filter and appears on a single external security blocklist. VirusTotal scans recorded 12 detections out of 91 scanned security vendors, providing modest but concrete evidence of malicious activity.

No additional public indicators such as page title, SSL certificate details, or HTTP response codes have been published, leaving the exact content of the hosted page unverified. Defenders should add cantiyanaaa59-gif.github.io to network‑level deny lists, monitor DNS queries for the associated IP, and enable URL filtering that references PhishDestroy and the observed blocklist entry. Continuous re‑scanning with VirusTotal or similar aggregators is recommended to track changes in vendor detections, and any future observations of page content or credential‑harvesting behavior should be incorporated into incident response documentation.