rksigmaboy[.]in

The domain rksigmaboy.in has been identified as a generic phishing site that impersonates Amazon to steal login credentials and financial information. This threat is categorized as a credential harvesting attack, commonly known as a phishing page. The site was designed to mimic the Amazon login portal, tricking users into entering their email and password.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows that 17 out of 95 security vendors flag this domain as malicious. The domain was registered through Endurance Digital Domain Technology Private Limited and was created on March 04, 2026. It resolves to IP address 208.91.198.101 and uses an SSL certificate issued by Let's Encrypt (R12), which gives it a false sense of legitimacy. Additionally, the domain appears on one security blocklist and has been flagged by Google Safe Browsing.

As of the latest check, the domain is offline, indicating that it has been taken down following identification and reporting by security researchers. However, users who may have visited the site before takedown should monitor their accounts for unauthorized access and change their Amazon passwords immediately. The risk remains elevated due to potential data already captured by the attackers. PhishDestroy recommends using a password manager and enabling two-factor authentication on all online accounts to mitigate future threats.