# PhishDestroy domain threat record: satyam-kumar-mishra.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/satyam-kumar-mishra.github.io/
Machine-readable companion: https://phishdestroy.io/domain/satyam-kumar-mishra.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 13:49:02 UTC
- Last availability or vendor check: 2026-10-21 01:14:22 UTC
- Stored record updated: 2026-10-22 14:24:05 UTC
- VirusTotal detections in the stored snapshot: 9/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: netflix

## Stored infrastructure

- Observed IP address: 185.199.110.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09f9e-6a8a-71c8-8002-b9e27a37f81f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/satyam-kumar-mishra.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.satyam-kumar-mishra.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://satyam-kumar-mishra.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
satyam-kumar-mishra.github.io is a phishing page that impersonated Netflix and targeted subscribers who could be persuaded to sign in or update their account. It was hosted as a personal project site on GitHub Pages. PhishDestroy first saw it on 2026-09-14, and it went offline the next day, 2026-09-15. A check on 2026-10-19 found the site still dead, with no content served at the root.

How the scam works
Netflix lures usually arrive as emails or texts claiming a payment failed or the account is about to be suspended. They link to a copy of the Netflix sign-in or billing page. Anything typed there, such as email, password and often full card details, goes straight to the operator. The stolen data is then used to take over accounts, resell logins or run card fraud. The page carried the generic browser title "Document", which is the default in many HTML templates, while its content was classified as Netflix impersonation.

Evidence
Nine of 89 VirusTotal engines flagged the site on 2026-09-14. Among them were Google Safe Browsing, Netcraft, Fortinet, Sophos, Emsisoft, G-Data, Gridinsoft and alphaMountain.ai. That is a modest count, but the vendors span browser protection, anti-phishing feeds and endpoint security, so the verdicts are independent of each other. Google Safe Browsing labeled it SOCIAL_ENGINEERING. urlscan.io returned a malicious verdict and identified Netflix as the imitated brand. The site is also on the PhishDestroy blocklist.

Infrastructure
The operator did not register a domain. The page ran as a subdomain of GitHub's free static hosting, which costs nothing and borrows the reputation of a trusted platform. It resolved to GitHub Pages' shared Fastly network in the United States, the same front end that serves countless legitimate project sites. Because this setup is so cheap, it can be abandoned and recreated under a new account within minutes, and the page did go dark a day after detection.

What to do
If you entered your Netflix password here, change it now, and also change it on any other service where you reused it. Then sign out of all devices from your Netflix account settings. If you submitted card details, call your bank to block the card and dispute any charges you don't recognize. Be wary of follow-up messages about your account, and always reach Netflix by typing its address yourself. Defenders should block this hostname and report any copies to GitHub and to Netflix's security team, since similar pages tend to reappear under fresh usernames.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09f9e-6a8a-71c8-8002-b9e27a37f81f/
VirusTotal report: https://www.virustotal.com/gui/domain/satyam-kumar-mishra.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=satyam-kumar-mishra.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:49 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09f9e-6a8a-71c8-8002-b9e27a37f81f.png
  Captured: 2026-09-14 13:49:02 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/24c2119c-451c-4a8d-992f-5e9aa62b6744.png
  Captured: 2026-09-14 13:52:11 UTC
  Source report: https://radar.cloudflare.com/scan/24c2119c-451c-4a8d-992f-5e9aa62b6744
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09d6f-7df3-767e-8e5a-a15efa8f4bbe.png
  Captured: 2026-09-14 01:02:11 UTC
  Source report: https://urlscan.io/result/01a09d6f-7df3-767e-8e5a-a15efa8f4bbe/
  SHA-256: d79ad46aa78484dbb25d05085b9f2937b8e8ed1620160dcbc0ec330e4f81713f
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09da7-34c9-7118-9e5d-4f903704839c.png
  Captured: 2026-09-14 02:03:10 UTC
  Source report: https://urlscan.io/result/01a09da7-34c9-7118-9e5d-4f903704839c/
  SHA-256: d79ad46aa78484dbb25d05085b9f2937b8e8ed1620160dcbc0ec330e4f81713f
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a030-5501-701e-a6c3-bd3f5a3ee8c1.png
  Captured: 2026-09-14 13:52:03 UTC
  Source report: https://urlscan.io/result/01a0a030-5501-701e-a6c3-bd3f5a3ee8c1/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0a9fe-8ad7-711e-b5cb-86d8a543ba26.png
  Captured: 2026-09-16 11:33:58 UTC
  Source report: https://urlscan.io/result/01a0a9fe-8ad7-711e-b5cb-86d8a543ba26/
  SHA-256: d79ad46aa78484dbb25d05085b9f2937b8e8ed1620160dcbc0ec330e4f81713f
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0c138-3fe5-72f9-b513-c1c0ef7d720b.png
  Captured: 2026-09-20 23:48:16 UTC
  Source report: https://urlscan.io/result/01a0c138-3fe5-72f9-b513-c1c0ef7d720b/
  SHA-256: d79ad46aa78484dbb25d05085b9f2937b8e8ed1620160dcbc0ec330e4f81713f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:24Z",
        "uuid": "01a09f9e-6a8a-71c8-8002-b9e27a37f81f",
        "scanned_at": "2026-09-14T11:12:41Z",
        "final_url": "https://satyam-kumar-mishra.github.io/CLONE1/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://satyam-kumar-mishra.github.io/CLONE1/",
                "from": "https://satyam-kumar-mishra.github.io/CLONE1",
                "status": 301
            }
        ],
        "ip": "185.199.109.153",
        "ptr": "cdn-185-199-109-153.github.com",
        "domains": [
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "104.17.24.14",
            "185.199.109.153"
        ],
        "asns": [
            "13335",
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "4fc1dd6a81193fbf4fb880c4d19cdf215dd9e78d33d44a8a8caa6ac4155f6ced",
        "script_hashes": [
            "c07e3ee923625fd1670f00b4f06518dbb2948222d76c33ecbacf0d43a937bc7c"
        ],
        "globals": [
            "ques1"
        ],
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 42,
        "tls_valid_days": 89,
        "requests": 18,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:16Z",
        "uuid": "24c2119c-451c-4a8d-992f-5e9aa62b6744",
        "scanned_at": "2026-09-14T13:52:11Z",
        "final_url": "https://satyam-kumar-mishra.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://satyam-kumar-mishra.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "satyam-kumar-mishra.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.110.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:57:37Z",
        "analysis_at": "2026-10-18T17:20:00Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 10,
            "suspicious": 1,
            "undetected": 32
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "malware",
            "Lionic": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-13T08:41:43Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            }
        ],
        "dns_at": "2026-10-18T17:20:29Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```