sakshitulsyan[.]github[.]io

This domain is flagged as a high-risk threat due to Amazon brand impersonation designed for credential theft. The fraudulent site mimics the official Amazon login and checkout pages, targeting users with realistic UI elements to harvest account credentials, payment details, and personal information. Analysis indicates a deliberate attempt to exploit trust in the Amazon brand, with potential secondary objectives including session hijacking or malware delivery via malicious redirects. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 185.199.109.153, hosted on AS54113 (Fastly, Inc.) in the United States. It is registered through GitHub, Inc., leveraging GitHub Pages for hosting. The SSL certificate is issued by Let's Encrypt (R12), providing a false sense of security. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious. The page title, 'Amazon.com-Shop Online,' directly impersonates the legitimate Amazon brand. The domain appears on one security blocklist, and the current status remains active as of the latest verification. Mitigation requires immediate action to prevent credential theft and financial fraud. Network-level blocking of the domain and its resolving IP (185.199.109.153) is recommended for all endpoints and perimeter security systems. Users who may have interacted with the site should be instructed to reset Amazon passwords using multi-factor authentication and review recent account activity for unauthorized transactions. Security teams should monitor for indicators of compromise, including anomalous login attempts or changes to payment methods. Browser-based protections, such as enforcing strict same-origin policies and disabling JavaScript execution for untrusted domains, can reduce exposure to similar threats. Additionally, user awareness training should emphasize verifying domain authenticity before entering credentials, particularly for high-value brands like Amazon.