tusharr-mishra[.]github[.]io

This domain, tusharr-mishra.github.io, is flagged as a high-risk generic phishing site targeting Amazon users. The page replicates the official Amazon branding, including the title 'Amazon.com. Spend less. Smile more.', to deceive victims into entering login credentials or payment details. No specific drainer kit signatures have been identified, but the infrastructure aligns with credential-harvesting campaigns commonly hosted on compromised or abused platforms like GitHub Pages. Infrastructure analysis reveals the domain resolves to the IPv6 address 2606:50c0:8000::153, hosted on AS54113 (Fastly, Inc.) in the US. The domain is registered through GitHub, Inc., and its SSL certificate is issued by Let's Encrypt (R12). VirusTotal detection shows 7 out of 95 security vendors flagging the domain as malicious. It appears on one security blocklist and is actively blocked by PhishDestroy. No Google Safe Browsing (GSB) status is currently available for this domain. The domain remains active as of the latest verification, posing an ongoing threat to users who may encounter it through phishing emails, malicious ads, or social engineering tactics. Recommended response actions include blocking the domain at the network level, reporting it to GitHub for takedown, and alerting affected users to reset credentials if exposed. Despite existing detections, the low blocklist count suggests the threat may still evade some security controls, maintaining a high residual risk for unprotected systems.