snehagarasiya7-rgb[.]github[.]io

This domain, snehagarasiya7-rgb.github.io, is currently operating as an active credential harvesting platform specifically targeting Amazon users. Analysis indicates the site presents a fraudulent Amazon login interface designed to capture user credentials, payment details, and personal information. The threat classification is confirmed as generic phishing with a high-risk assessment due to its operational status and brand impersonation of a major e-commerce platform. Infrastructure analysis reveals the domain is hosted through GitHub, Inc. as a GitHub Pages site, resolving to the IPv6 address 2606:50c0:8003::153 within AS54113 (Fastly, Inc.) in the United States. The site employs a Let's Encrypt SSL certificate (R12) to create a false sense of legitimacy. Detection metrics show 12 of 95 security vendors on VirusTotal have flagged this domain as malicious, while it appears on one additional security blocklist. The page title explicitly displays 'Amazon,' confirming the targeted brand impersonation strategy. Current monitoring confirms the phishing infrastructure remains active as of this analysis. Organizations and individuals are advised to implement immediate blocking of this domain at the network perimeter. Users who may have interacted with this site should initiate password resets for their Amazon accounts and enable multi-factor authentication. Security teams should monitor for credential reuse attempts across other platforms, particularly financial services and email accounts. The GitHub Pages hosting method demonstrates threat actors' continued exploitation of legitimate cloud infrastructure to bypass traditional security controls.