# PhishDestroy domain threat record: simran201864.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/simran201864.github.io/
Machine-readable companion: https://phishdestroy.io/domain/simran201864.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 13:46:30 UTC
- Last availability or vendor check: 2026-10-21 01:14:35 UTC
- Stored record updated: 2026-10-22 14:24:14 UTC
- VirusTotal detections in the stored snapshot: 9/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: netflix

## Stored infrastructure

- Observed IP address: 185.199.110.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09f9e-64ea-77b5-be44-41795c924f59/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/simran201864.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.simran201864.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://simran201864.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
simran201864.github.io is a GitHub Pages site that copied the look of Netflix and was flagged as an impersonation phishing page aimed at Netflix subscribers. PhishDestroy first saw it on 2026-09-14. It went offline on 2026-09-15, and on 2026-10-19 the address still served no content at its root.

How the scam works
The page carried the title "Netflix Clone", a name typical of student coding exercises, while we classified it as impersonation phishing because it reproduced Netflix branding closely enough to be used against real users. Netflix lookalikes usually reach victims through messages about a failed payment, an expired subscription or a locked account. The fake page then asks for the email and password, and often a card number for "billing verification." A stolen login lets the attacker take over or resell the streaming account, and card details are typically used for fraudulent charges.

Evidence
On 2026-09-14, the day we first saw the site, 9 of 89 VirusTotal engines flagged it. The vendors named include alphaMountain.ai, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Netcraft and Sophos. That count is modest, but these are independent engines, several of them phishing-focused, and they reached the same verdict within a day. urlscan.io also rated the page malicious and recognized Netflix as the imitated brand. PhishDestroy lists the domain on its blocklist.

Infrastructure
The site sat on a free github.io subdomain, so no domain registration was involved and anyone with a GitHub account could publish it in minutes. Traffic was served from 185.199.110.153 on Fastly, Inc. in the US, the shared delivery network behind GitHub Pages. That setup gives a phishing page a trusted-looking hostname and valid HTTPS at no cost. It also makes takedown fast, which matches the one-day gap between first detection and the site going dark.

What to do
If you entered your Netflix login here, change that password immediately, along with any other account that used the same password. Then review the signed-in devices on your Netflix account and sign out of all of them. If you typed in card details, call your bank to block the card and dispute any unfamiliar charges. Treat follow-up emails or texts about your Netflix billing with suspicion, and open the app directly instead of tapping links. Defenders should block the hostname and search mail logs for messages linking to it around 2026-09-14.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09f9e-64ea-77b5-be44-41795c924f59/
VirusTotal report: https://www.virustotal.com/gui/domain/simran201864.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=simran201864.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:48 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09f9e-64ea-77b5-be44-41795c924f59.png
  Captured: 2026-09-14 13:46:30 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/eb9f602c-3a61-4941-913c-09982188a102.png
  Captured: 2026-09-14 13:48:45 UTC
  Source report: https://radar.cloudflare.com/scan/eb9f602c-3a61-4941-913c-09982188a102
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09d6f-81f7-711e-a615-3036ca7a6146.png
  Captured: 2026-09-14 01:02:12 UTC
  Source report: https://urlscan.io/result/01a09d6f-81f7-711e-a615-3036ca7a6146/
  SHA-256: 027751afe80f89000a40731c1865a5cd1e49fcc69bbbe191d264c92554f53408
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a09da7-26a3-76bf-90a5-8173480a7093.png
  Captured: 2026-09-14 02:02:58 UTC
  Source report: https://urlscan.io/result/01a09da7-26a3-76bf-90a5-8173480a7093/
  SHA-256: 027751afe80f89000a40731c1865a5cd1e49fcc69bbbe191d264c92554f53408
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a02c-ab38-73df-a6a9-082656b5d50d.png
  Captured: 2026-09-14 13:48:03 UTC
  Source report: https://urlscan.io/result/01a0a02c-ab38-73df-a6a9-082656b5d50d/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af5a-1e61-7069-a5af-9172a968217b.png
  Captured: 2026-09-17 12:32:01 UTC
  Source report: https://urlscan.io/result/01a0af5a-1e61-7069-a5af-9172a968217b/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0c138-3f35-75cb-99e5-dfdddbc1c1fa.png
  Captured: 2026-09-20 23:48:24 UTC
  Source report: https://urlscan.io/result/01a0c138-3f35-75cb-99e5-dfdddbc1c1fa/
  SHA-256: fd62796be2e33aed1a65793f94d3c9ff2f77777cf775329e6e8f64195c6e16d6
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c653-a3eb-73da-8e0b-431f3d154bd5.png
  Captured: 2026-09-21 23:36:12 UTC
  Source report: https://urlscan.io/result/01a0c653-a3eb-73da-8e0b-431f3d154bd5/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:25Z",
        "uuid": "01a09f9e-64ea-77b5-be44-41795c924f59",
        "scanned_at": "2026-09-14T11:12:39Z",
        "final_url": "https://simran201864.github.io/netflix/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://simran201864.github.io/netflix/",
                "from": "https://simran201864.github.io/netflix",
                "status": 301
            }
        ],
        "ip": "2606:50c0:8001::153",
        "domains": [
            "images.unsplash.com"
        ],
        "ips": [
            "2a04:4e42:400::720",
            "2606:50c0:8001::153"
        ],
        "asns": [
            "54113"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "d56ae62ed345a28e07d9dacee17fa1a683c4c9c80f12558900388a281f987ed8",
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 42,
        "tls_valid_days": 89,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:17Z",
        "uuid": "eb9f602c-3a61-4941-913c-09982188a102",
        "scanned_at": "2026-09-14T13:48:45Z",
        "final_url": "https://simran201864.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://simran201864.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "simran201864.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "simran201864.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "simran201864.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "simran201864.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "simran201864.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "name": "simran201864.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "simran201864.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "simran201864.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.110.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:57:40Z",
        "analysis_at": "2026-10-19T05:47:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 48,
            "malicious": 12,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "malware",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-13T09:11:10Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            }
        ],
        "dns_at": "2026-10-19T05:47:40Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```