sasighanta[.]github[.]io

This domain, sasighanta.github.io, is flagged as an active credential theft operation targeting users of online shopping platforms. Analysis indicates the site presents a fabricated e-commerce interface designed to harvest login credentials, payment details, and personal information. The page title 'online shopping' suggests an attempt to impersonate legitimate retail services, though no specific brand name is overtly misused in available metadata. The infrastructure lacks direct indicators of a known drainer kit, but the credential harvesting mechanics align with common phishing toolkits deployed in similar campaigns. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to the IP address 185.199.110.153, which is associated with AS54113 (Fastly, Inc.) and geolocated in the United States. The domain is registered through GitHub, Inc., with a Let's Encrypt SSL certificate (R12) providing HTTPS encryption. Security vendor detections on VirusTotal show 5 out of 95 engines flagging the domain as malicious, while it appears on one additional security blocklist. No Google Safe Browsing (GSB) listing is currently recorded, though this may reflect a lag in detection rather than a clean status. The site remains active as of the latest assessment, with no evidence of takedown or remediation efforts. Users are advised to avoid interaction with the domain, as credential theft attempts may still be operational. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for related indicators such as SSL certificate fingerprints or subdomain variations. The remaining risk is classified as high due to the domain's continued accessibility and the potential for financial or identity data exposure.