ritikpandey007[.]github[.]io

PhishDestroy has identified a high-risk brand impersonation campaign targeting Amazon customers, with the active phishing domain ritikpandey007.github.io. This threat is specifically designed to harvest credentials and financial data by mimicking Amazon's login interface, as confirmed by the page title 'Amazon'. The domain's use of a legitimate GitHub Pages subdomain and a valid Let's Encrypt SSL certificate makes it appear more trustworthy to unsuspecting users.

Technical indicators are severe: VirusTotal reports 22 out of 95 security vendors flagging this domain, and it already appears on 1 security blocklist. The domain was registered through MarkMonitor, Inc. on February 21, 2026, and resolves to IP 185.199.108.153, which is associated with GitHub Pages infrastructure. Despite being newly created, the domain's high detection rate and active status underscore its malicious intent. PhishDestroy's analysis confirms the domain impersonates Amazon with a matching page title, increasing the likelihood of successful phishing attempts.

Users should avoid interacting with this domain entirely. Never enter Amazon credentials, payment details, or personal information on any page hosted at ritikpandey007.github.io. Verify legitimate Amazon URLs by checking for 'amazon.com' in the address bar and look for the padlock icon indicating a valid security certificate. Report any suspicious emails or messages directing to this domain to Amazon's security team and your email provider. Enable two-factor authentication on your Amazon account as an additional safeguard.