harshmhatre1317[.]github[.]io

Analysis of harshmhatre1317.github.io indicates that the site is currently offline, returning an HTTP 404 response. The domain was created on May 16, 2026 and is registered through GitHub, Inc., suggesting that the attacker leveraged GitHub Pages for hosting. Infrastructure inspection shows resolution to the IPv6 address 2606:50c0:8000::153, which belongs to AS54113 Fastly, Inc., located in the United States. The presence of Varnish and Fastly in the technology stack aligns with the Fastly CDN used by GitHub Pages, confirming the hosting arrangement.

The site presented an SSL certificate issued by Let’s Encrypt with revision R12, indicating that encryption was in place despite the inactive status. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist, reflecting a high likelihood of malicious intent. VirusTotal scans recorded ten detections out of ninety‑one contributing security vendors, reinforcing the classification as a threat.

The page title was observed as "Amazon" and the domain is explicitly noted to impersonate the Amazon brand, matching the declared brand target. Defenders should block the IPv6 address and any associated hostnames, monitor for additional domains registered through GitHub that use similar naming patterns, and enforce URL filtering that flags pages with the Amazon title originating from non‑Amazon hosting services. Continuous observation of Fastly‑associated traffic for anomalous requests to this address is recommended, as is inclusion of the domain in internal threat intelligence feeds to prevent future exploitation.