kishwar18k[.]github[.]io

This domain, kishwar18k.github.io, is flagged as an active credential theft operation targeting Amazon users. Analysis indicates the page replicates Amazon's login interface to harvest user credentials, a common tactic in account takeover schemes. The use of a GitHub Pages subdomain suggests an attempt to exploit the platform's trusted reputation while evading traditional domain-based blocking mechanisms. Technical indicators confirm the domain's malicious nature. It resolves to IP address 185.199.110.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a legitimate provider frequently abused in phishing campaigns. VirusTotal detection rates show 6 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist (PhishDestroy). The registrar is GitHub, Inc., with no creation date available for the subdomain, though GitHub Pages typically provisions these dynamically. No Google Safe Browsing (GSB) listing was observed at the time of analysis, though this may reflect detection latency rather than benign status. The domain remains active as of this report, posing a continued risk to users. While GitHub Pages infrastructure is not inherently malicious, the hosting of credential theft content violates platform policies, and abuse reports have likely been submitted. Users encountering this domain should avoid interaction, particularly inputting login credentials or personal information. Organizations are advised to implement network-level blocking for the IP address and domain, while monitoring for related subdomains that may emerge. The combination of brand impersonation, active status, and partial detection coverage underscores the need for layered security controls to mitigate credential theft risks.