This GitHub Pages site posed as Netflix to trick subscribers into handing over their account credentials and likely their billing details. PhishDestroy first flagged it on 2026-09-06. The page went offline on 2026-09-11 and was still dead when rechecked on 2026-10-19. Its title now reads "Site not found · GitHub Pages", which is GitHub's standard placeholder for a removed project. We classify the site as Netflix impersonation phishing.
How the scam works
Netflix phishing usually starts with an email or SMS claiming a payment failed or the account is on hold. The link leads to a cloned sign-in page. Victims who enter their email and password are often shown a second form asking for card number, expiry date and CVV to "update billing". Free hosting under a github.io address lends the page a veneer of legitimacy and costs the operator nothing. Victims lose control of their streaming account and can face fraudulent card charges. Reused passwords also expose other services.
Evidence
When VirusTotal checked the site on 2026-09-12, 14 of 89 security engines flagged it. Those included alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet and G-Data. Agreement across that many separate vendors is a strong signal for a short-lived page. urlscan.io returned a malicious verdict and matched the page to the Netflix brand, which independently confirms what was being imitated. The site is listed on the PhishDestroy blocklist.
Infrastructure
The page lived on a user subdomain of github.io, so the operator registered nothing. They only needed a free GitHub account, and the registrar on file is GitHub, Inc. Traffic was served through GitHub Pages' Fastly-backed network in the US at 185.199.108.153, an address shared by countless legitimate projects. That shared address means blocking by IP is not practical. The site was live only about five days after we first saw it before going dark, a disposable lifecycle typical of throwaway phishing pages.
What to do
If you entered your Netflix login here, change your Netflix password right away and sign out of all devices from your account settings. Change the same password anywhere else you reused it. If you typed card details, call your bank to cancel the card and dispute any unfamiliar charges. Watch for follow-up messages that claim to be from Netflix support. Defenders should block the full subdomain, search mail logs for messages linking to it, and report similar github.io clones to GitHub for removal.
発行者 Let's Encrypt· stored validity ends in 53 days
Network & certificates
Stored technical evidence
Network & DNS
Shared CDN edge
Resolved IP
185.199.108.153
Network ASN
AS54113
Organization
Fastly, Inc.
Observed location
San Francisco, US
Server header
GitHub.com
Edge-IP の評判はこのドメインに起因しません。
Location describes the IP network.
TLS証明書
Issuer
Let's Encrypt
Valid from
2026-08-02 23:38:02
Valid until
2026-10-31 23:38:01
Hostname coverage
Certificate hostname mismatch
Validity
Within stored validity dates
Collection time
2026-09-06 13:02:04 UTC
Collection source
PhishDestroy collector
Certificate fingerprint71f1077db377fd7b8d68380da66fa68238a303b2911bcb770b3b2a426693cf84Certificate names · 3 SANs
github.com
github.io
githubusercontent.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Fastly is a cloud computing services provider. Fastly's cloud platform provides a content delivery network, Internet security services, load balancing, and video & streaming services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
