ujjalmondal23[.]github[.]io

This domain, ujjalmondal23.github.io, is flagged as an active credential theft operation targeting Amazon users. Analysis indicates the site employs brand impersonation techniques, presenting a fabricated Amazon login interface to deceive victims into submitting account credentials. No evidence of a crypto drainer or wallet interaction script was observed, distinguishing this as a pure credential harvesting campaign rather than a financial asset theft attempt. Infrastructure analysis reveals the domain is hosted on GitHub Pages, resolving to the IP address 185.199.109.153. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. Detection metrics show 10 out of 95 security vendors on VirusTotal have flagged this domain, while it appears on a single security blocklist. The domain leverages GitHub, Inc. as its registrar, and no historical WHOIS data indicates a creation date, as GitHub Pages domains are dynamically generated under user accounts. Google Safe Browsing status is not explicitly provided, but the presence on one blocklist suggests limited but confirmed malicious classification. As of the latest assessment, ujjalmondal23.github.io remains active, continuing to host the fraudulent Amazon login page. No takedown or suspension has been observed, and the GitHub repository associated with the domain remains accessible. The risk level is classified as high due to the combination of active credential theft, brand impersonation, and minimal detection coverage, which may allow the campaign to persist undetected by less comprehensive security tools. Users are advised to avoid interacting with the domain, verify website authenticity through official channels, and report the fraudulent page to both Amazon and GitHub for expedited removal. Organizations should update web filtering rules to block this domain and monitor for credential reuse attempts stemming from harvested data.