hskgkyigj[.]github[.]io

The domain hskgkyigj.github.io is identified as a high-risk credential theft phishing site. The page title 'Петиции' suggests a potential impersonation of a Russian or Ukrainian petition platform. No specific brand impersonation or crypto drainer kit has been identified, but the domain is actively being used to steal user credentials.

Analysis indicates that the domain has a VirusTotal score of 14/95, suggesting a moderate level of detection among security vendors. The domain is registered through GitHub, Inc., and resolves to the IP address 185.199.111.153, which is located in the United States and is part of the AS54113 Fastly, Inc. network. The SSL certificate is issued by Let's Encrypt / R12, a common certificate authority for legitimate and malicious sites alike. The domain appears on 2 security blocklists and is currently listed as active in the Google Safe Browsing database.

The current status of hskgkyigj.github.io is active, and it remains a high-risk threat. Immediate response actions include blocking the domain at the network level, educating users about the risks of clicking on suspicious links, and implementing multi-factor authentication for any accounts that may have been compromised. Despite the domain being flagged by security vendors and blocklists, the remaining risk is significant due to its active status and the potential for credential theft. Organizations should monitor for any unauthorized access attempts and consider deploying additional security measures such as endpoint protection and regular security audits.