satyam-v3[.]github[.]io

This domain, satyam-v3.github.io, is identified as an active high-risk phishing resource targeting users of a major streaming platform. Analysis indicates the site mimics the Netflix login interface, a tactic commonly employed to harvest user credentials through fraudulent input forms. No explicit drainer kit signatures have been observed, but the domain exhibits characteristics consistent with credential theft campaigns, including the use of legitimate SSL certificates and content delivery networks to lend an appearance of authenticity. Infrastructure analysis reveals the following technical indicators: the domain is registered through GitHub, Inc., and resolves to the IP address 185.199.111.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let's Encrypt (YR2). Detection metrics show the domain is flagged by 13 out of 95 security vendors on VirusTotal, appears on one security blocklist, and is explicitly labeled as phishing by Google Safe Browsing. The page title explicitly displays 'Netflix,' reinforcing the impersonation theme. No historical WHOIS data is available due to the domain's registration under a privacy-preserving platform. As of the latest assessment, satyam-v3.github.io remains active and continues to pose a significant threat to unsuspecting users. The use of a reputable hosting provider and valid SSL certificate increases the likelihood of successful deception. Users are advised to avoid interacting with the domain, and network-level blocking of the IP 185.199.111.153 is recommended to mitigate exposure. Organizations should update their threat intelligence feeds to include this domain and its associated indicators of compromise. Given the domain's persistence and the sophistication of its infrastructure, continued monitoring is warranted to track potential shifts in hosting or evasion tactics.