aribafiroz2207[.]github[.]io

The domain aribafiroz2207.github.io was registered on June 18, 2026 through GitHub, Inc. and is hosted on the GitHub Pages infrastructure, as indicated by the presence of Varnish, GitHub Pages, and Fastly in the technology fingerprint. The site resolves to IP address 185.199.110.153, which is owned by Fastly (AS54113) and geolocated to the United States. An SSL certificate issued by Let’s Encrypt (R12) is present, confirming that HTTPS is correctly configured for the domain. An HTTP request to the root URL returns a 404 status code, and the page title retrieved from the response metadata is "Amazon," matching the declared brand target. This suggests an attempt to impersonate Amazon, even though the content is currently unavailable.

VirusTotal analysis shows that seven of ninety‑one scanning engines flagged the domain, reflecting a moderate level of detection across independent security products. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, indicating that at least one anti‑phishing service has taken protective action. No nameserver records are resolvable, which is consistent with the GitHub Pages hosting model.

The combination of a recent registration date, brand‑targeted page title, low trust score, and multiple vendor detections points to a probable brand‑impersonation campaign that is currently offline. Because the site is returning 404, active malicious payloads could not be verified, leaving the exact nature of the phishing content uncertain. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP range, and add the domain to internal threat‑intel feeds. Ongoing observation of the IP address and any future re‑activation of the site is recommended, as the infrastructure (GitHub Pages and Fastly) could be reused for new impersonation attempts.