rohitmanis1[.]github[.]io

This domain, rohitmanis1.github.io, is flagged as a high-risk generic phishing site impersonating Amazon. Analysis indicates the page title explicitly displays 'amazon,' suggesting an attempt to deceive users into believing they are interacting with the legitimate Amazon platform. No specific drainer kit signatures have been identified, but the domain exhibits standard phishing infrastructure designed for credential harvesting or payment redirection. The threat actor appears to be leveraging GitHub Pages for hosting, a tactic commonly observed in phishing campaigns due to its low-cost and reputable hosting environment. Infrastructure analysis reveals the following technical indicators: the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.108.153, associated with AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for malicious domains due to its free and automated issuance process. VirusTotal detection shows 7 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and Google Safe Browsing (GSB) status is not explicitly provided but is likely flagged given the detection rate. No creation date is available, but the use of GitHub Pages suggests recent deployment, as such services are frequently abused for short-lived phishing campaigns. The domain remains active as of the latest verification, posing an ongoing risk to users. Response actions should include immediate blocking of the domain and IP address in enterprise and consumer security solutions. Users who may have interacted with the site are advised to reset credentials for Amazon and any other accounts where the same password was reused. Organizations should monitor for signs of credential stuffing or unauthorized access originating from this infrastructure. Despite its active status, the domain's reliance on GitHub Pages may lead to swift takedown, though threat actors often migrate to new hosts. Continuous monitoring of related GitHub Pages subdomains is recommended to preemptively identify follow-up campaigns.