nanigudivaka[.]github[.]io

This domain is flagged as a high-risk phishing site specializing in brand impersonation, specifically targeting users with a fake Amazon login portal. The fraudulent page, titled 'Amazon Project,' is designed to harvest credentials by mimicking legitimate Amazon authentication flows, a tactic commonly associated with credential theft and subsequent account compromise. Analysis indicates the domain nanigudivaka.github.io is registered through GitHub, Inc., and resolves to the IP address 185.199.111.153, geolocated in the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. The domain appears on one security blocklist and is flagged by 10 out of 95 security vendors on VirusTotal, with the current status remaining active. The infrastructure leverages GitHub Pages, a hosting service frequently abused for phishing due to its free availability and association with trusted domains. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at the network perimeter. Organizations should deploy web filtering rules to prevent access to the domain and its resolved IP address. End-users should be educated on identifying brand impersonation tactics, such as scrutinizing URL structures, checking for HTTPS validity, and verifying the legitimacy of login portals through official channels. Credential managers or multi-factor authentication (MFA) should be enforced to mitigate the impact of stolen credentials. Security teams are advised to monitor for indicators of compromise (IOCs) associated with this domain, including the resolved IP and SSL certificate thumbprint, to detect potential breaches.