# PhishDestroy domain threat record: sanath2700.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/sanath2700.github.io/
Machine-readable companion: https://phishdestroy.io/domain/sanath2700.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 01:25:22 UTC
- Last availability or vendor check: 2026-10-21 01:14:28 UTC
- Stored record updated: 2026-10-22 14:24:05 UTC
- VirusTotal detections in the stored snapshot: 6/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: netflix

## Stored infrastructure

- Observed IP address: 185.199.109.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09849-1909-743a-ad42-933d12edc8ff/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/sanath2700.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.sanath2700.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://sanath2700.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
sanath2700.github.io was a page on a GitHub Pages user subdomain that copied the look of Netflix and targeted people who use or are thinking about the streaming service. PhishDestroy first detected it on 2026-09-14 and classified it as an impersonation phishing page. It went offline that same day. When we checked again on 2026-10-19, the site was still dead, and its root returned no content.

How the scam works
The page called itself "Netflix Concept Prototype — Browse by Country/Region". That title presents the site as a design mock-up, while we classified it as Netflix impersonation. Fake Netflix pages usually copy the familiar browse interface to win trust, then send visitors to a sign-in or billing step. There they ask for the account email, password and payment card details. A visitor who fills those in hands over a working streaming account and card data that can be resold or used for fraud. Hosting on a free github.io subdomain lets the operator put a page up quickly without registering a domain.

Evidence
Six of 89 VirusTotal engines flagged the site on 2026-09-14: alphaMountain.ai, ESET, Fortinet, G-Data, Gridinsoft and Sophos. That is a minority of engines, but it includes several established endpoint and web-filtering vendors. urlscan.io gave the page a malicious verdict and recognised Netflix branding in its content, which matches our classification. PhishDestroy is the only blocklist listing it so far.

Infrastructure
The site was served by GitHub Pages, with traffic delivered through Fastly, Inc.'s network from an address in the US. That shared, reputable infrastructure means the IP address says nothing about the operator. Many legitimate projects sit on the same servers, so blocking should target the specific subdomain rather than the network. The subdomain was taken down on the day we detected it, which points to a short-lived page rather than a long-running operation.

What to do
If you entered your Netflix email and password here, change the Netflix password right away and sign out of all devices in your account settings. Change the same password on any other service where you reused it. If you typed in card details, contact your bank to block the card and review recent charges, and watch for follow-up emails or texts that claim to be from Netflix billing. Defenders should block this exact github.io subdomain and look through proxy and email logs for visits on or around 2026-09-14. Similar Netflix lures appearing on other GitHub Pages subdomains should be reported to GitHub.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09849-1909-743a-ad42-933d12edc8ff/
VirusTotal report: https://www.virustotal.com/gui/domain/sanath2700.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=sanath2700.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:52 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09849-1909-743a-ad42-933d12edc8ff.png
  Captured: 2026-09-14 01:25:22 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3cd843d4-9dd1-4f28-80e8-f1e30c1291ce.png
  Captured: 2026-09-14 01:27:57 UTC
  Source report: https://radar.cloudflare.com/scan/3cd843d4-9dd1-4f28-80e8-f1e30c1291ce
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09d86-f6cd-726e-8202-c1cc308bf993.png
  Captured: 2026-09-14 01:27:48 UTC
  Source report: https://urlscan.io/result/01a09d86-f6cd-726e-8202-c1cc308bf993/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bf3a-f565-719b-9268-9434181f0cfe.png
  Captured: 2026-09-20 14:32:06 UTC
  Source report: https://urlscan.io/result/01a0bf3a-f565-719b-9268-9434181f0cfe/
  SHA-256: c8a8bab6634ce5aea71cae86f45e4f51dfea3cf518d0b7ae277216021bea655e

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:42Z",
        "uuid": "01a09849-1909-743a-ad42-933d12edc8ff",
        "scanned_at": "2026-09-13T01:02:10Z",
        "final_url": "https://sanath2700.github.io/NetflixRegionFix/",
        "status": 200,
        "ip": "185.199.111.153",
        "ptr": "cdn-185-199-111-153.github.com",
        "domains": [
            "images.unsplash.com"
        ],
        "ips": [
            "151.101.194.208",
            "185.199.111.153"
        ],
        "asns": [
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "7956b26b612ecbfe6d30279c34419bc6ed8367e5fac2b0a76597855174f33341",
        "globals": [
            "escapeXml",
            "hashCode",
            "fallbackArt",
            "photoArt",
            "catalog",
            "allCatalog",
            "showToast",
            "setNav",
            "saveList",
            "inList",
            "toggleList",
            "openDetails",
            "card",
            "rowSection",
            "attachCards",
            "hero",
            "renderStandardPage",
            "renderGames",
            "renderMyList",
            "renderCountries",
            "renderSearch",
            "render",
            "PHOTO_BASE",
            "PHOTO_IDS",
            "countries",
            "regionalSeeds",
            "state",
            "app",
            "toast",
            "deferredInstallPrompt"
        ],
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 4,
        "apex_age_days": 4,
        "tls_age_days": 41,
        "tls_valid_days": 89,
        "requests": 21,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:27Z",
        "uuid": "3cd843d4-9dd1-4f28-80e8-f1e30c1291ce",
        "scanned_at": "2026-09-14T01:27:57Z",
        "final_url": "https://sanath2700.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://sanath2700.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "sanath2700.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "name": "sanath2700.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.110.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:58:08Z",
        "analysis_at": "2026-10-13T03:39:10Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 12,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-08T06:11:17Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            }
        ],
        "dns_at": "2026-10-13T03:44:23Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```