sanria40[.]github[.]io

This domain, sanria40.github.io, is identified as a high-risk phishing resource targeting users with credential harvesting schemes. Analysis indicates the domain mimics legitimate GitHub authentication portals, presenting users with fraudulent login interfaces designed to exfiltrate account credentials. The infrastructure leverages GitHub Pages, a common tactic to exploit trusted hosting environments and evade initial detection. No specific drainer kit signatures have been confirmed at this time, though the phishing pages exhibit standard form-submission behaviors consistent with credential theft operations. Technical indicators reveal the domain resolves to the IP address 185.199.108.153, associated with AS54113 (Fastly, Inc.), a provider frequently utilized by GitHub Pages. The domain is registered through GitHub, Inc., and employs a Let's Encrypt SSL certificate (YR2). Detection metrics show 17 out of 95 security vendors on VirusTotal flag the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist and is actively blocked by at least one anti-phishing service. No creation date is publicly available due to GitHub Pages' ephemeral nature, though the domain remains operational as of analysis. Current status confirms the domain is still active, posing an ongoing threat to users who may encounter it through phishing links distributed via email, social media, or malicious advertisements. Response actions by hosting providers and security entities remain limited, as GitHub Pages domains require manual review for takedown. The risk level remains high due to the domain's persistence, low detection rates among some vendors, and the critical nature of compromised GitHub credentials, which could lead to source code theft, supply chain attacks, or further account takeovers. Users are advised to verify domain authenticity before entering credentials, enable multi-factor authentication on all accounts, and report suspicious links to security teams for further analysis.