rajatsaini90420[.]github[.]io

This domain, rajatsaini90420.github.io, presents a high-risk phishing threat targeting Amazon users. The page displays an imitation Amazon Sign-In interface designed to harvest login credentials, including usernames, passwords, and potentially payment details. Visitors who enter their information risk account takeover, financial fraud, or identity theft, as stolen credentials are often sold on underground markets or used for unauthorized transactions. Analysis indicates the domain is actively hosted on GitHub Pages infrastructure, a legitimate platform frequently abused for phishing due to its free hosting and trusted reputation. The page title, Amazon Sign-In, matches the targeted brand, increasing the likelihood of deception. Security vendors have flagged the domain in 19 out of 95 scans on VirusTotal, confirming malicious intent. The domain resolves to the IP address 185.199.109.153, associated with Fastly, Inc. (AS54113), and uses a Let's Encrypt SSL certificate (R12) to appear legitimate. It is currently listed on one security blocklist and remains operational as of this report. If you or someone in your organization visited this domain and entered credentials, immediate action is required. First, change the password for the affected Amazon account and enable multi-factor authentication if not already active. Review recent account activity for unauthorized purchases or changes. Monitor linked financial accounts for suspicious transactions and consider placing a fraud alert with credit bureaus if payment details were entered. Report the incident to the legitimate service provider and relevant authorities, such as the Anti-Phishing Working Group or national cybercrime units. Avoid reusing passwords across services to prevent further compromise.