vishnutejaswiniravipati[.]github[.]io

The domain vishnutejaswiniravipati.github.io is currently flagged as an active credential theft operation targeting Amazon users. Analysis indicates the page is designed to harvest login credentials by impersonating the legitimate Amazon platform, a tactic commonly associated with account takeover fraud and unauthorized financial transactions. The domain remains operational as of the latest assessment, posing a direct risk to users who may unknowingly submit sensitive authentication details. Infrastructure analysis reveals the domain is hosted on GitHub Pages, registered through GitHub, Inc., and resolves to the IP address 185.199.109.153, associated with AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common but not exclusive indicator of legitimate hosting. The domain is flagged by 5 of 95 security vendors on VirusTotal, and appears on at least one security blocklist, specifically PhishDestroy. The page title explicitly displays 'Amazon,' reinforcing the brand impersonation strategy. No historical registration data is available, as the domain leverages GitHub's subdomain infrastructure, which does not provide traditional WHOIS records. Current risk assessment classifies this domain as high-severity due to its active status, brand impersonation of a major e-commerce platform, and direct targeting of user credentials. Users are strongly advised to avoid interacting with the domain and to verify the authenticity of any Amazon-related communications through official channels. Organizations should update web filtering policies to block access to this domain and monitor for indicators of compromise, including unusual login attempts or unauthorized transactions linked to Amazon accounts. Security teams are recommended to review logs for connections to 185.199.109.153 and correlate with other threat intelligence feeds to identify potential exposure.