oktaesignauthentication[.]sanxinenv[.]com

The domain oktaesignauthentication.sanxinenv.com is classified as a high-risk phishing site specifically designed to impersonate Okta authentication portals. Analysis confirms this domain is actively engaged in credential harvesting, presenting fraudulent login interfaces to deceive users into submitting sensitive account details. Current infrastructure remains operational, posing an ongoing threat to individuals and organizations relying on Okta identity services. Infrastructure analysis reveals the domain was registered on November 06, 2018, through Gname.com Pte. Ltd. and currently resolves to the IP address 89.163.155.33. Security vendor assessments on VirusTotal indicate that 5 of 95 engines have flagged this domain as malicious. The site employs a Let's Encrypt SSL certificate, uses PHP and Nginx web technologies, and supports HTTP/3, which may contribute to its apparent legitimacy. No legitimate association with Okta or its official authentication services has been established. This domain remains active and should be treated as a confirmed phishing resource. Immediate action is recommended: block the domain and its resolving IP at network perimeter controls, invalidate any credentials potentially exposed through interaction with this site, and deploy indicators of compromise (IOCs) across security monitoring systems. Organizations should also conduct internal awareness campaigns to alert users about phishing attempts impersonating authentication providers, particularly those mimicking Okta login workflows.