hongtintuc999-vn[.]github[.]io

On July 22, 2026, analysis of the domain hongtintuc999-vn.github.io identified it as an active generic phishing infrastructure. The domain resolves to the IP address 185.199.108.153, which belongs to the GitHub Pages hosting service operated by GitHub, Inc. Registration data indicates the domain was created through GitHub’s automated registration process, and no traditional registrar name is associated beyond the platform provider. The domain is currently listed on two security blocklists and is explicitly blocked by PhishDestroy and OpenPhish, confirming its recognition by commercial mitigation services.

VirusTotal reports that eight of ninety‑five scanning engines have flagged the domain as malicious, providing additional independent confirmation of its threat status. Nameserver information could not be retrieved, and no SSL certificate details, HTTP response codes, or page title metadata were supplied in the intelligence feed, leaving those vectors unverified at this time. The limited visible infrastructure suggests the operator relies on GitHub Pages to host malicious content, a technique that benefits from the platform’s high reputation and shared IP address space, making detection by IP‑based allow‑lists less effective.

Defenders should continue to block the domain at perimeter controls, update URL filtering rules to include the observed host, and monitor for any new subdomains that resolve to the same GitHub Pages IP range. Because the hosting service can host many unrelated benign sites, reputation‑based blocking should be applied cautiously, and any future changes in the domain’s content or associated URLs should be re‑scanned by malware analysis tools. Ongoing collection of HTTP headers, TLS certificate fingerprints, and page content is recommended to enrich future threat‑intel records and reduce false positives.