anshita-web[.]github[.]io

This domain, anshita-web.github.io, is flagged as a high-risk credential theft operation targeting users through deceptive login prompts or data submission forms. Analysis indicates no direct brand impersonation or cryptocurrency drainer kit association, but the infrastructure aligns with credential harvesting tactics. The domain leverages GitHub Pages for hosting, a common technique to exploit trusted platforms for malicious purposes. Infrastructure analysis reveals the domain resolves to IP address 185.199.109.153, a shared GitHub Pages endpoint. It is registered through GitHub, Inc., with no distinct creation date available due to GitHub’s automated subdomain provisioning. The SSL certificate is issued by Let’s Encrypt, a standard for GitHub-hosted pages. VirusTotal reports 7/95 security vendors flagging the domain as malicious, while Google Safe Browsing (GSB) status remains unconfirmed. Technologies detected include Varnish, Fastly, and GitHub Pages, which are legitimate but frequently abused for phishing. The domain remains active as of the latest verification, with no takedown or mitigation observed. Users are advised to block access to this URL and avoid interacting with any content hosted on anshita-web.github.io. Organizations should update web filters to include this domain and monitor for related subdomains or redirects. Despite the absence of a visible phishing page, the detection by multiple security vendors and the domain’s association with credential theft warrant continued vigilance.