itx-sajjad[.]github[.]io

This domain is flagged as a high-risk phishing infrastructure specifically designed to impersonate the Amazon brand, targeting users with a fraudulent storefront. Analysis indicates the site operates as a generic phishing threat, likely harvesting login credentials, payment details, or personal information under the guise of a legitimate e-commerce platform. The page title explicitly reads 'Amazon Clone,' confirming the intent to deceive users into believing they are interacting with an official Amazon property. Infrastructure analysis reveals the domain itx-sajjad.github.io is hosted on GitHub Pages, resolving to the IP address 185.199.110.153, which is geolocated in the United States under AS54113 (Fastly, Inc.). The SSL certificate is issued by Let's Encrypt (R12), a common but not inherently trustworthy provider in phishing contexts. VirusTotal detection metrics show 5 out of 95 security vendors flagging this domain as malicious, while Google Safe Browsing and at least one other security blocklist have classified it as phishing. The domain remains active as of the latest assessment, with no evidence of takedown or remediation efforts. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its resolving IP at the network perimeter. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate thumbprint into security controls, including web filters, endpoint protection, and email gateways. Users who may have interacted with this site should be instructed to reset credentials for any accounts accessed during the session, enable multi-factor authentication, and monitor financial statements for unauthorized transactions. Security teams are advised to conduct a retrospective analysis of logs for connections to 185.199.110.153 or related GitHub Pages subdomains to identify potential prior compromises.