saharaexpress[.]co[.]in

Analysis of saharaexpress.co.in indicates that the domain is actively leveraged for generic phishing operations. The site is protected by a Let's Encrypt (YR1) SSL certificate and is registered through Endurance International Group India Private Limited. DNS resolution points to the IP address 108.163.194.170, and the domain is served by the nameservers ns1.superdnssite.com, ns2.superdnssite.com, ns65.superdnssite.com, and ns66.superdnssit. The domain was created on March 22, 2012 and remains active as of the reporting date. Threat intelligence sources show that the domain appears in three AlienVault OTX pulses, and VirusTotal scans have flagged it with detections from 10 of 91 security vendors, reinforcing its malicious reputation. While the specific phishing landing pages have not been publicly disclosed, the convergence of SSL issuance, hosting details, and multiple vendor detections suggests a sustained infrastructure. Defenders should block outbound connections to 108.163.194.170, add the domain and its associated nameservers to deny lists, and monitor for any traffic patterns that reference saharaexpress.co.in. Continued vigilance is recommended given the high risk rating and active status of the infrastructure.