sahkib159[.]github[.]io

This domain, sahkib159.github.io, is identified as a high-risk phishing portal specifically targeting Amazon users. Analysis indicates the page mimics the Amazon login interface, likely designed to harvest account credentials and payment details. No specific drainer kit signatures have been confirmed, but the page title explicitly matches the targeted brand, suggesting a credential phishing campaign. Technical indicators reveal the following: the domain is flagged by 1/95 security vendors on VirusTotal, with a detection ratio of 1%. It is hosted on GitHub Pages infrastructure, resolving to IP address 185.199.108.153, which is geolocated in the US under AS54113 (Fastly, Inc.). The domain appears on one security blocklist and is currently marked as active. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. No specific creation date is available, but the domain remains operational and unmitigated. As of the latest assessment, sahkib159.github.io remains active and continues to pose a high risk to users. The infrastructure is hosted on a legitimate service, complicating takedown efforts. Users are advised to block the domain at the network level and avoid interacting with any pages hosted under this subdomain. Organizations should update their web filtering rules to include this domain and monitor for credential reuse attempts from affected accounts.