# PhishDestroy domain threat record: umarali39t-netizen.github.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/umarali39t-netizen.github.io/
Machine-readable companion: https://phishdestroy.io/domain/umarali39t-netizen.github.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 14:06:53 UTC
- Last availability or vendor check: 2026-10-21 01:14:29 UTC
- Stored record updated: 2026-10-22 14:24:48 UTC
- VirusTotal detections in the stored snapshot: 0/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: netflix

## Stored infrastructure

- Observed IP address: 185.199.110.153
- Registrar in stored WHOIS data: GitHub Pages
- Last stored HTTP status: 404
- Registration date (registry RDAP, github.io): 2013-03-08 19:12:48 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a001-fde7-771b-bc88-96c908cf0642/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/umarali39t-netizen.github.io
- Certificate Transparency search: https://crt.sh/?q=%25.umarali39t-netizen.github.io
- Web Archive lookup: https://web.archive.org/web/*/https://umarali39t-netizen.github.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
umarali39t-netizen.github.io is a Netflix impersonation page hosted as a GitHub Pages project. It copied the look of the streaming service, so anyone who reached it expecting their Netflix account was the target. PhishDestroy first flagged it on 2026-09-14. It went offline on 2026-09-15 and was still dead at the last check on 2026-10-19, with nothing served at the root.

How the scam works
The page carried the title "Netflix Clone" and reproduced Netflix branding closely enough that urlscan.io matched it to the brand. Pages like this show a familiar sign-in screen, then often ask for a billing update or card re-verification. Whatever is typed goes to the operator: the account password, the email behind it, and any card details. The title reads like a developer's clone project, while PhishDestroy classified the live page as impersonation phishing.

Evidence
urlscan.io returned a malicious verdict and identified Netflix as the imitated brand. That is the strongest independent signal here. VirusTotal showed 0 detections out of 89 engines when it was checked on 2026-09-14, the same day PhishDestroy flagged it, so most vendor filters were not yet warning anyone. Of the blocklists we track, only PhishDestroy lists the domain.

Infrastructure
The site ran on a GitHub Pages subdomain, which costs nothing and needs no domain registration. That makes setup quick and disposable. Traffic resolved to Fastly, Inc. in the US, the content network that fronts GitHub Pages, so the IP is shared with many legitimate sites and says little about the operator. The page was gone within about a day of detection.

What to do
If you entered your Netflix login on this page, change the password from the official app or by typing the address yourself, and sign out of all devices from the account settings. Change the password anywhere else you used the same one, and secure the email account tied to Netflix with a new password and two-factor authentication. If you entered card details, contact your bank to block the card and watch for unfamiliar charges. Defenders should block this hostname, report similar github.io impersonation pages to GitHub, and treat any page titled as a brand "clone" that asks for real credentials as hostile.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a001-fde7-771b-bc88-96c908cf0642/
VirusTotal report: https://www.virustotal.com/gui/domain/umarali39t-netizen.github.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=umarali39t-netizen.github.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:44 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a001-fde7-771b-bc88-96c908cf0642.png
  Captured: 2026-09-14 14:06:53 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/43ad52a8-28c5-4d01-8871-8cc774ce866f.png
  Captured: 2026-09-14 14:09:26 UTC
  Source report: https://radar.cloudflare.com/scan/43ad52a8-28c5-4d01-8871-8cc774ce866f
  SHA-256: 945c4699741e079455940b39652bded28d3c3ecc2dde09ffe7aaa9f9d3ff0ddc
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0b04f-4b8e-74f9-b7ad-70a81a85628f.png
  Captured: 2026-09-17 16:59:48 UTC
  Source report: https://urlscan.io/result/01a0b04f-4b8e-74f9-b7ad-70a81a85628f/
  SHA-256: 6f8cf461abf6f0981fbdf94a9989850c5ea3b679650ebe74f85399fed3922ea9
- URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b1f3-5b29-761f-978f-4f1f44eb511c.png
  Captured: 2026-09-18 00:38:37 UTC
  Source report: https://urlscan.io/result/01a0b1f3-5b29-761f-978f-4f1f44eb511c/
  SHA-256: d3ec93f5b585984efd23b5c5bfdbc910bee023802029295c60dbb05fea850c66
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c1f7-baec-77bb-a5e3-65925fbf62ee.png
  Captured: 2026-09-21 03:17:21 UTC
  Source report: https://urlscan.io/result/01a0c1f7-baec-77bb-a5e3-65925fbf62ee/
  SHA-256: d3ec93f5b585984efd23b5c5bfdbc910bee023802029295c60dbb05fea850c66

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:10Z",
        "uuid": "01a0a001-fde7-771b-bc88-96c908cf0642",
        "scanned_at": "2026-09-14T13:01:28Z",
        "final_url": "https://umarali39t-netizen.github.io/Netflix-Clone/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://umarali39t-netizen.github.io/Netflix-Clone/",
                "from": "https://umarali39t-netizen.github.io/Netflix-Clone",
                "status": 301
            }
        ],
        "ip": "185.199.111.153",
        "ptr": "cdn-185-199-111-153.github.com",
        "domains": [
            "image.tmdb.org"
        ],
        "ips": [
            "169.150.247.38",
            "185.199.111.153"
        ],
        "asns": [
            "60068",
            "54113"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "doc_hash": "d89973c305f691aa874f0b1c3e7e61914d5a81267b831d6110146574262141b6",
        "tls": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR1",
            "subject": "*.github.io",
            "protocol": "TLS 1.3",
            "valid_to": "2026-10-31T23:38:01Z",
            "valid_from": "2026-08-02T23:38:02Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 42,
        "tls_valid_days": 89,
        "requests": 14,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Netflix"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "GitHub.com",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31556952"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:11Z",
        "uuid": "43ad52a8-28c5-4d01-8871-8cc774ce866f",
        "scanned_at": "2026-09-14T14:09:26Z",
        "final_url": "https://umarali39t-netizen.github.io/",
        "status": 404,
        "history": [
            {
                "url": "https://umarali39t-netizen.github.io/",
                "status": 404
            }
        ],
        "dom_hash": "35bbdd99a249decabdc93f6b809b030db834533d4d78fe69529a214489fae670",
        "doc_hash": "70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "umarali39t-netizen.github.io",
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "name": "umarali39t-netizen.github.io",
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            }
        ],
        "dnssec_valid": false,
        "ip": "185.199.110.153",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2026-08-12T09:08:04Z",
            "expires": "2027-03-08T19:12:48Z",
            "nameservers": [
                "ns-692.awsdns-22.net",
                "ns-1622.awsdns-10.co.uk",
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:57:21Z",
        "analysis_at": "2026-10-20T10:37:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 12,
            "suspicious": 2,
            "undetected": 31
        },
        "detections": {
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Netcraft": "malicious",
            "LevelBlue": "suspicious",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "Criminal IP": "phishing",
            "PrecisionSec": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "MarkMonitor Inc.",
        "created": "2013-03-08T19:41:10Z",
        "expires": "2027-03-08T19:12:48Z",
        "updated": "2026-08-12T09:08:04Z",
        "first_seen": "2026-09-13T18:11:16Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8001::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.110.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "sectigo.com"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.109.153"
            },
            {
                "ttl": 3600,
                "type": "CAA",
                "value": "letsencrypt.org"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8000::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.108.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8002::153"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "185.199.111.153"
            },
            {
                "ttl": 3600,
                "type": "AAAA",
                "value": "2606:50c0:8003::153"
            }
        ],
        "dns_at": "2026-10-20T10:37:20Z",
        "jarm": "29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c",
        "cert": {
            "san": [
                "*.github.com",
                "*.github.io",
                "*.githubusercontent.com",
                "github.com",
                "github.io",
                "githubusercontent.com"
            ],
            "issuer": "Let's Encrypt / YR1",
            "serial": "6a65e5d3279ba564a4de74eb5d64478dbb8",
            "sha256": "f2f9a159ce50a0a168b3eaeaf2fced5addd49ba38e2bf63248f057a139fc7856",
            "subject": "*.github.io",
            "valid_to": "2026-12-29T23:44:45Z",
            "valid_from": "2026-09-30T23:44:46Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2013-03-08T19:12:48Z",
            "updated": "2025-02-25T20:53:31Z",
            "expires": "2027-03-08T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited"
            ],
            "nameservers": [
                "dns1.p05.nsone.net",
                "dns2.p05.nsone.net",
                "dns3.p05.nsone.net",
                "ns-1622.awsdns-10.co.uk",
                "ns-692.awsdns-22.net"
            ],
            "dnssec": "unsigned"
        }
    }
}
```