vanshikaakhandelwal[.]github[.]io

On July 23, 2026, analysis of the domain vanshikaakhandelwal.github.io identified it as an active generic phishing infrastructure. The domain is hosted on GitHub Pages and resolves to the IPv4 address 185.199.111.153, which is owned by GitHub, Inc. The registration record shows that the domain was created through GitHub, Inc., indicating that the attacker leveraged a legitimate hosting provider to obtain a trusted TLS certificate automatically associated with the *.github.io namespace. Google Safe Browsing has classified the URL under the “social engineering” category, and the domain appears on one external security blocklist, confirming that it has been observed in phishing campaigns. Additional defensive feeds, such as PhishDestroy, also list the domain as blocked, reinforcing its malicious reputation.

VirusTotal reports that the domain has been scanned by 91 anti‑malware vendors, none of which returned a detection at the time of the scan; the absence of detections does not constitute a validation of safety. The domain’s authoritative nameserver lookup returned NS_NOT_FOUND, suggesting that DNS records are either dynamic or concealed, a technique commonly used to evade automated reconnaissance. No public SSL certificate anomalies, HTTP response codes, or page‑title metadata were available for analysis, leaving the content of the hosted page unverified.

Based on the available indicators, defenders should treat the domain as high‑risk and incorporate it into blocklists, URL filtering, and endpoint protection rules. Continuous monitoring of the IP address 185.199.111.153 and the associated GitHub Pages sub‑domain is advised, as the infrastructure can be reused for future phishing deployments. Organizations employing web‑proxy or DNS filtering solutions should explicitly deny traffic to this domain, and security teams should remain vigilant for any newly observed artifacts that reference the same hosting pattern.