thevelkrid[.]github[.]io

This domain, thevelkrid.github.io, is actively engaged in credential harvesting operations targeting Amazon users. Analysis indicates the site presents a fraudulent Amazon login interface designed to capture usernames, passwords, and potentially payment details from victims. The threat actor leverages free hosting infrastructure to deploy the phishing kit, which closely mimics Amazon's legitimate authentication portal, including visual elements and form fields that appear authentic to unsuspecting users. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain resolves to IP address 185.199.108.153, hosted on Fastly's network (AS54113) in the United States. It employs a Let's Encrypt SSL certificate (R12) to create a false sense of security. Security vendors have detected the threat with 14 out of 95 engines flagging the domain on VirusTotal. The domain appears on one security blocklist and remains registered through GitHub's hosting service. The page title explicitly displays 'Amazon,' further confirming the impersonation attempt. Users who may have interacted with this domain should immediately take corrective action. First, change Amazon account credentials from a secure device, preferably one not previously used to access the phishing site. Enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions or configuration changes. Consider revoking and reissuing any saved payment methods. Organizations should update their web filtering solutions to block this domain and its associated IP address. Security teams should examine network logs for connections to 185.199.108.153 and thevelkrid.github.io to identify potentially compromised systems within their environment.