kishan814[.]github[.]io

This domain, kishan814.github.io, is flagged as a high-risk generic phishing site targeting Amazon users. Analysis indicates the site mimics the Amazon brand to deceive victims into submitting login credentials, payment details, or personal information. The page title explicitly displays 'Amazon,' and the infrastructure is hosted on GitHub Pages, a common tactic for low-cost phishing deployments. No specific drainer kit signatures have been identified, but the domain exhibits characteristics consistent with credential harvesting campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.110.153, hosted under AS54113 (Fastly, Inc.) in the United States. It is registered through GitHub, Inc., and uses a Let's Encrypt SSL certificate (R12). The domain appears on one security blocklist and is flagged by 4 out of 95 security vendors on VirusTotal. While the exact creation date is not publicly disclosed, the domain remains active and unmitigated by GitHub at the time of assessment. Current status shows the phishing site is still operational, posing an ongoing threat to unsuspecting users. Response actions by hosting providers or security entities appear limited, as the domain continues to resolve and serve malicious content. The remaining risk is classified as high due to the domain's active status, brand impersonation, and low detection rate among security vendors. Users are advised to avoid interaction with kishan814.github.io, and organizations should update blocklists to include this domain. Monitoring for additional indicators of compromise, such as redirected URLs or associated IP ranges, is recommended for comprehensive threat mitigation.