maheshkalvakuntala-ctrl[.]github[.]io

The domain maheshkalvakuntala-ctrl.github.io was observed on July 29 2026 as an active high‑risk generic phishing infrastructure. Registration information shows the domain was created through GitHub, Inc., indicating the use of a reputable code‑hosting service for malicious purposes. DNS resolution points to the IP address 185.199.108.153, which belongs to GitHub Pages hosting and is shared among many legitimate projects, complicating attribution. Google Safe Browsing classifies the site as a social‑engineering threat, and the domain is currently listed on a single security blocklist.

PhishDestroy has confirmed the domain as blocked, providing additional confidence in its malicious intent. VirusTotal analysis reports 18 of 91 security vendors flagging the domain, demonstrating a moderate consensus among scanners. No further public evidence such as SSL certificate details, HTTP response codes, page titles, or content analysis is available at this time, leaving the exact phishing payload and target brand undefined. The lack of additional telemetry means that defenders cannot determine whether the site serves credential‑harvesting forms, malware downloads, or other malicious redirects.

Nevertheless, the combination of registrar abuse, hosting on a popular static‑site platform, Safe Browsing labeling, and multiple vendor detections indicates a purposeful phishing campaign. Defenders are advised to add maheshkalvakuntala-ctrl.github.io to web‑filtering and DNS‑sinkhole rules, monitor outbound connections to the associated IP address, and consider broader blocks of GitHub Pages subdomains exhibiting similar characteristics. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection status. Incident response teams should treat any traffic to this domain as suspicious and apply standard credential‑theft mitigation procedures.