sat-id[.]com

Analysis of the domain sat-id.com indicates high-risk phishing infrastructure designed to impersonate satellite or identity verification services. Registered on February 21, 2026, through Amazon Registrar, Inc., the domain resolves to IP address 108.138.7.30, hosted on Amazon Web Services (AS16509) in Germany. The site is actively serving content with an HTTP 200 status, suggesting operational readiness. Infrastructure analysis reveals the use of Amazon CloudFront and Varnish, common technologies for content delivery and caching, which may be leveraged to obscure malicious activity or improve phishing site performance. The domain appears on at least one security blocklist (PhishDestroy) and is flagged by 2 of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not detailed in available intelligence.

Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. The SSL certificate, issued by Amazon RSA 2048 M04, is valid but does not mitigate the domain's malicious intent, as phishing sites frequently use legitimate certificates to appear credible. Nameservers are consistent with Amazon's DNS infrastructure, which is neutral in isolation but aligns with the broader hosting pattern observed in phishing campaigns. The page title, 'sat-id.com,' provides no additional context about the site's content or target, leaving the exact nature of the phishing scheme uncertain.

No evidence links the domain to a specific brand, kit, or scam subtype (e.g., courier, investment, or crypto-related), so it is classified as a generic phishing domain. Defenders should treat this domain as active and malicious. Recommended actions include blocking the domain and IP at the network level, monitoring for connections to 108.138.7.30 or related CloudFront endpoints, and alerting users to potential phishing attempts referencing 'satellite identity' or similar themes.