# sara-tv.biz — SUSPICIOUS

> sara-tv.biz masquerades as a streaming login portal used in active credential-harvesting scams. Check the full report.

## Summary
PhishDestroy identifies sara-tv.biz as a currently active credential-harvesting domain under formal investigation.

This domain was flagged for credential phishing and currently resolves to 91.206.71.84, a NICENIC INTERNATIONAL GROUP CO., LIMITED registration created on November 23, 2017 that presently carries a clean 0/95 VirusTotal score despite hosting a Google Trust Services SSL certificate. No public blocklists currently list the domain, leaving users without external protections.

Organizations should immediately block both the domain and the IP at perimeter controls and proxy layers, scan endpoint DNS logs for lookups to sara-tv.biz, and remind users that any unexpected streaming login prompts are likely credential phishing traps rather than legitimate services.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2017-11-23 13:52:14
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 91.206.71.84

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/2b4d8088-1694-4da8-bdfe-6562929f4e6c
- PhishDestroy: https://phishdestroy.io/domain/sara-tv.biz/
- LLM endpoint: https://phishdestroy.io/domain/sara-tv.biz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/sara-tv.biz/
Last updated: 2026-03-26