# 975126.com: Recorded redirect to www.google.com search homepage | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/975126.com/ Machine-readable companion: https://phishdestroy.io/domain/975126.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: Last known active - First observed by PhishDestroy: 2026-11-08 22:58:33 UTC - Selected availability observation: 2026-11-09T04:03:59Z - Stored record updated: 2026-11-09 05:00:07 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: flagged ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): Google ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED - Registrar country in stored WHOIS data: US - Last stored HTTP status: 302 (observed: 2026-11-09T04:03:59Z) - Registration date in stored WHOIS data: 2026-10-07 09:28:44 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1bd5f-dbbb-777a-83ba-5a2549223485/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/975126.com - Certificate Transparency search: https://crt.sh/?q=%25.975126.com - Web Archive lookup: https://web.archive.org/web/*/https://975126.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy records a redirect from 975126.com to www.google.com, showing the Google search homepage with trending searches in French. On 2026-11-08, 975126.com redirected to www.google.com. The destination page shows the Google search homepage in French, with the Google logo above a search bar offering voice and image search options, and a "Connexion" button in the top right corner. Below the search bar, a "Recherches populaires" section lists trending queries such as "david spector," "tempete," "largo winch film 3," "jensen huang," "game awards," "rougeole," and "rc lens marseille." The footer indicates the region as France and includes links for dark theme, settings, privacy, and terms. Package revision: d56b88edd9be43b1b5efdc7110d9a5e9baa9a08cf72c9ac76d1e0525248c309a Text generated (not scan time): 2026-11-09 00:37:05 Reviewed evidence snapshot: {"domain":"975126.com","screenshot_available":true,"capture_contract":"verified-capture-20261102","plain_text_contract":1,"capture_context":{"submitted_host":"975126.com","final_host":"www.google.com","redirects":[{"to":"https://975126.com/","from":"http://975126.com/","status":307},{"to":"https://google.com/","from":"https://975126.com/","status":302},{"to":"https://www.google.com/","from":"https://google.com/","status":301}],"captured_at":"2026-11-08T22:55:45.035000Z","uuid":"01a1bd5f-dbbb-777a-83ba-5a2549223485","report_url":"https://urlscan.io/result/01a1bd5f-dbbb-777a-83ba-5a2549223485/","sha256":"23d655baf29801dbee097075ac4a40a7027ab0181a91aede4a5bc84f86e5f71a","relationship":"redirect_destination"},"redirect_text_policy":"explicit-redirect-v1","virustotal_public_summary":"","page_paragraph_target_characters":678} Source facts (timestamps as stored): {"record_id":1866689,"first_recorded_at":"2026-11-08 23:58:33","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":1,"denominator":92,"malicious":0,"suspicious":1,"vendors":{"SOCRadar":"suspicious"},"observed_at":"2026-11-08T08:30:44Z","checked_at":null,"fetched_at":"2026-11-08T23:37:38Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":1,"denominator":92,"malicious":null,"suspicious":null,"vendors":["SOCRadar"],"observed_at":"2026-11-08 08:30:44","checked_at":"2026-11-09 00:37:39","fetched_at":"2026-11-08 23:37:39","time_basis":"as stored; legacy timezone not established"},"record_source":"phishdestroy.technologies.vt","vendor_labels":{"SOCRadar":"suspicious"},"vendor_names":["SOCRadar"],"stats":{"timeout":0,"harmless":56,"malicious":0,"suspicious":1,"undetected":35}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"flagged","verdict":1,"checked_at":"2026-11-09 00:32:57"},"spamhaus":{"source":"Spamhaus","verdict":"DBL_SPAM","checked_at":"2026-11-09 00:31:43"},"availability":{"state":"alive","label_key":"availability.active","detail_key":"detail.latest_reachability","params":[],"source":"current_http_probe","record_id":1866689,"scope":"checked_url","observed_at":"2026-11-09T04:03:59Z","http_status":302,"http_observed_at":"2026-11-09T04:03:59Z","stored_http_code":302,"stored_http_observed_at":"2026-11-09T04:03:59Z","legacy_site_status":"alive","supports_outcome_badge":false,"content_classification":"unknown","content_classification_at":"2026-11-09T00:26:03Z","registration_state":"unknown","policy":"20261102-dated-availability-v2"}} ## Stored page captures - Stored capture: https://i.ibb.co/5g4Y79rs/b40ab6e99540.png - URLScan · 2026-11-08 → www.google.com: https://screenshots.phishdestroy.io/us/01a1bd5f-dbbb-777a-83ba-5a2549223485.png Captured: 2026-11-08 22:55:45 UTC Source report: https://urlscan.io/result/01a1bd5f-dbbb-777a-83ba-5a2549223485/ SHA-256: 23d655baf29801dbee097075ac4a40a7027ab0181a91aede4a5bc84f86e5f71a - URLScan · 2026-11-08 → www.google.com: https://screenshots.phishdestroy.io/us/01a1bd67-35d3-771c-8a7e-99352dbfa434.png Captured: 2026-11-08 23:03:47 UTC Source report: https://urlscan.io/result/01a1bd67-35d3-771c-8a7e-99352dbfa434/ SHA-256: 863859bd15358c8bcdb204fc42f4074eea3566bbba532d41047d64f600ab64ce - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/36d285bc-be71-4258-9f47-163d8686ee5f.png Captured: 2026-11-08 23:34:05 UTC Source report: https://radar.cloudflare.com/scan/36d285bc-be71-4258-9f47-163d8686ee5f SHA-256: d1e8094bc22905c1bf327a15717770b8ddcdea6f477392e4a24503d269671ebc - URLQuery: https://screenshots.phishdestroy.io/uq/367e8b23-ff6b-4c9e-a015-0def99c3a9de.png Source report: https://urlquery.net/report/367e8b23-ff6b-4c9e-a015-0def99c3a9de SHA-256: bba1a193ee8bcf29aea02dce68f26147559898738f33500f474b365cf544a33c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-11-08T23:01:26Z", "uuid": "01a1bd5f-dbbb-777a-83ba-5a2549223485", "scanned_at": "2026-11-08T22:55:45Z", "final_url": "https://www.google.com/", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://975126.com/", "from": "http://975126.com/", "status": 307 }, { "to": "https://google.com/", "from": "https://975126.com/", "status": 302 }, { "to": "https://www.google.com/", "from": "https://google.com/", "status": 301 } ], "ip": "142.251.154.119", "domains": [ "play.google.com", "ogads-pa.clients6.google.com", "www.gstatic.com", "google.com", "975126.com" ], "ips": [ "2001:4860:4827:700::", "142.251.20.95", "2a00:1450:4001:c15::5f", "142.251.154.119", "188.114.96.3" ], "asns": [ "15169", "13335" ], "countries": [ "US", "DE" ], "link_domains": [ "www.google.fr", "accounts.google.com", "search.app.goo.gl", "support.google.com", "policies.google.com", "google.com", "about.google" ], "doc_hash": "4aa08c6b14fc74535332bdbba140b1b3c29b9d4b789d7b814f7f000b73ea6b3b", "script_hashes": [ "f986230ad208597e901d3b32e33758b75c4f368bbcc8b4eaf96e9aa94252af64", "297c1a8c59808b4344294154d21b6465edb503ce543e7b22d2d1716c513d1fc3", "fb33b685e077947b429e39c327d9aa94610d504808447a2eabbbd9b1a952f66a", "bafb5c09a110b8ba70f813a3fb43d21d157963f595c1c6600966842abaefaa1c", "b9ec36ca0beb3f371ce1efc2ffe3fed8fced7be27d923f8c961830f2eb9dafe6", "475a787adf6502d189663f1c46905920cf5977bf95c88275b9d80e12cdc1282a", "5f486019951fa98c6f2aca85c3af4f69e36a83f074a4ef85a199dfd29ec776b1" ], "globals": [ "_hst", "google", "jsac_init", "gws_wizbind", "sgLiteEarlyInstalled", "gbar_", "_F_toggles_gbar_", "gbar", "__PVT", "U3bHHf", "__gr", "sbmlhf", "W_jd", "WIZ_global_data", "IJ_values", "_", "_DumpException", "_s", "_qs", "loaded_h_0", "_xjs_toggles", "_F_toggles", "_F_installCss", "jsl", "_F_jsUrl", "closure_uid_810079899", "closure_lm_324919", "_hm", "Aᶜstate", "closure_lm_185070", "silkcbr", "silk", "_F_installCssProto", "wiz_progress", "rwt", "chromeConnection", "userfeedback" ], "cookies": [ "SEARCH_SAMESITE", "AEC", "__Secure-ENID" ], "storage_keys": [ "__sak", "_c;;i", "hsb;;1794178538503", "hsb;;1794178538502", "sb_wiz.zpc." ], "tls": { "san": [ "*.google.com", "*.appengine.google.com", "*.bdn.dev", "*.origin-test.bdn.dev", "*.cloud.google.com", "*.crowdsource.google.com", "*.datacompute.google.com", "*.google.ca", "*.google.cl", "*.google.co.in" ], "cipher": "AES_128_GCM", "issuer": "WE2", "subject": "*.google.com", "protocol": "QUIC", "valid_to": "2026-12-30T19:07:41Z", "valid_from": "2026-10-07T19:07:42Z" }, "domain_age_days": 4975, "apex_age_days": 4975, "tls_age_days": 32, "tls_valid_days": 83, "umbrella_rank": 5, "requests": 44, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-2aab354" ], "score": -96, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "gws", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "permissions-policy": "unload=()" } }, "cf": { "v": 1, "fetched_at": "2026-11-08T23:35:22Z", "uuid": "36d285bc-be71-4258-9f47-163d8686ee5f", "scanned_at": "2026-11-08T23:34:05Z", "final_url": "https://www.google.com/", "status": 200, "redirected": "off-domain", "history": [ { "url": "https://975126.com/", "status": 302 }, { "url": "https://google.com/", "status": 301 }, { "url": "https://www.google.com/", "status": 200 } ], "dom_hash": "3c4bbef5b3546b0b2d94e66ee5c73e8b936f930b9f9e962aa4ddca545e8fd8bf", "doc_hash": "2edf5189f8ca43dff50dd12764d1c24004807da60487d96a83f866b6554bdfcc", "domain_risks": [ "News, Portal & Search", "Technology", "Search Engines" ], "radar_rank": { "rank": 1, "bucket": "200" }, "dns": [ { "name": "google.com", "type": "A", "value": "192.178.24.142" }, { "name": "google.com", "type": "AAAA", "value": "2a00:1450:400e:810::200e" }, { "name": "ogads-pa.clients6.google.com", "type": "A", "value": "142.251.142.202" }, { "name": "ogads-pa.clients6.google.com", "type": "AAAA", "value": "2a00:1450:400e:811::200a" }, { "name": "play.google.com", "type": "A", "value": "142.251.151.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.156.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.155.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.154.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.152.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.153.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.157.7" }, { "name": "play.google.com", "type": "A", "value": "142.251.150.7" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:4827:700::" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:4829:700::" }, { "name": "play.google.com", "type": "AAAA", "value": "2001:4860:482c:700::" } ], "dnssec_valid": false, "ip": "127.0.1.13", "whois": { "registrar": "MarkMonitor Inc.", "created": "1997-09-15T04:00:00Z", "updated": "2019-09-09T15:39:04Z", "expires": "2028-09-14T04:00:00Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-11-08T23:37:38Z", "analysis_at": "2026-11-08T08:30:44Z", "stats": { "timeout": 0, "harmless": 56, "malicious": 0, "suspicious": 1, "undetected": 35 }, "detections": { "SOCRadar": "suspicious" }, "reputation": 0, "tags": [ "dga" ], "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-07T11:28:45Z", "expires": "2027-10-07T11:28:44Z", "updated": "2026-10-07T11:31:31Z", "first_seen": "2023-12-31T04:09:47Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3034::6815:ad8" }, { "ttl": 21600, "type": "NS", "value": "sky.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:83bc" }, { "ttl": 21600, "type": "NS", "value": "andronicus.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.10.216" }, { "ttl": 300, "type": "A", "value": "172.67.131.188" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "andronicus.ns.cloudflare.com" } ], "dns_at": "2026-11-08T08:36:07Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.975126.com", "975126.com" ], "issuer": "Let's Encrypt / YE1", "serial": "611ada2228b09b1f0343f42ecc91281b947", "sha256": "9900be647f997f04c2099f1f42486380fedcc5c2c5f5113a0612b5a1516563b8", "subject": "975126.com", "valid_to": "2027-01-05T10:35:37Z", "valid_from": "2026-10-07T10:35:38Z" }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "registrar_iana_id": "3765", "registrar_url": "https://nicenic.com", "created": "2026-10-07T11:28:44Z", "updated": "2026-10-07T11:28:45Z", "expires": "2027-10-07T11:28:44Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "andronicus.ns.cloudflare.com", "sky.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client transfer prohibited" ], "events": { "expiration": "2027-10-07T11:28:44Z", "registration": "2026-10-07T11:28:45Z", "registrar expiration": "2027-10-07T11:28:44Z", "last update of RDAP database": "2026-11-08T08:36:07Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-11-08T23:26:02Z", "mail_config": { "spf_lookups": 0 }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2024-08-26T09:57:51Z", "first": "2024-06-02T17:46:38Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.01, "avg_page_bytes": 1030 }, "social_tags": { "title": "Google" }, "trackers": { "requests": 11, "trackers": [ { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 3 }, { "name": "Google Beacons", "company": "Google", "country": "US", "category": "Site Analytics", "requests": 3 }, { "name": "Google CSP Reporting", "company": "Google", "country": "US", "category": "Utilities", "requests": 1 } ] }, "mixed_content": { "no_sri": [ "https://www.gstatic.com/og/_/js/k=og.asy.en_US.SkJ67skzkvI.2019.O/rt=j/m=_ac,_awd,ada,lldp,qads,abld/exm=/d=1/ed=1/rs=AA2YrTuXh4s5Z4NiRO7CnXzIHPrZtI8Mtg" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 302, "timings": { "dns": 2, "tls": 23, "wait": 643, "connect": 39, "download": 0 }, "response_ms": 707 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 300248, "co2_grams": 0.011, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "108.162.194.2", "host": "sky.ns.cloudflare.com" }, { "ip": "172.64.35.113", "host": "andronicus.ns.cloudflare.com" } ], "zone": "975126.com" }, "cookies": { "cookies": [ { "name": "__Secure-STRP", "secure": true, "same_site": "Strict" }, { "name": "SEARCH_SAMESITE", "same_site": "Strict" }, { "name": "AEC", "secure": true, "http_only": true, "same_site": "Lax" }, { "name": "NID", "secure": true, "http_only": true, "same_site": "None" } ] }, "location": { "ip": "2a06:98c1:3120::3", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "975126.com" }, "dns": { "A": [ "188.114.96.3", "188.114.97.3" ], "NS": [ "sky.ns.cloudflare.com", "andronicus.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"andronicus.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2419641105, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3120::3", "2a06:98c1:3121::3" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "SAMEORIGIN", "referrerPolicy": false, "xXSSProtection": "0", "permissionsPolicy": "unload=()", "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": "same-origin-allow-popups; report-to=\"gws\"", "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "2a06:98c1:3121::3", "family": 6 }, "redirects": { "chain": [ "https://975126.com", "https://google.com", "https://www.google.com/" ], "count": 2 }, "tech_stack": { "technologies": [ "Google Web Server", "Priority Hints", "HTTP/3" ] }, "linked_pages": { "external": [ "https://about.google/", "https://store.google.com/DE", "https://mail.google.com/mail/&ogbl", "https://www.google.com/imghp", "https://www.google.de/intl/de/about/products", "https://accounts.google.com/ServiceLogin", "https://support.google.com/websearch/answer/106230", "https://www.google.com/intl/de_de/ads/", "https://www.google.com/services/", "https://google.com/search/howsearchworks/", "https://sustainability.google/intl/de/klimaschutz/", "https://policies.google.com/privacy", "https://policies.google.com/terms", "https://www.google.com/preferences", "https://consent.google.com/d", "https://support.google.com/websearch/", "https://policies.google.com/technologies/cookies", "https://policies.google.com/privacy", "https://policies.google.com/terms" ], "external_count": 19, "internal_count": 3 }, "whois": { "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED", "created": "2026-10-07T11:28:44Z", "updated": "2026-10-07T11:31:31Z", "expires": "2027-10-07T11:28:44Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "andronicus.ns.cloudflare.com", "sky.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "gws", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "permissions-policy": "unload=()", "cross-origin-opener-policy": "same-origin-allow-popups; report-to=\"gws\"", "link": "; rel=\"compression-dictionary\"" } } } } ``` Capture recorded with this analysis (source URL, capture time and stored hash): {"url":"https://screenshots.phishdestroy.io/us/01a1bd5f-dbbb-777a-83ba-5a2549223485.png","source":"URLScan","report_url":"https://urlscan.io/result/01a1bd5f-dbbb-777a-83ba-5a2549223485/","captured_at":"2026-11-08T22:55:45Z","sha256":"23d655baf29801dbee097075ac4a40a7027ab0181a91aede4a5bc84f86e5f71a","model_image_sha256":"1c38f4ba4df96313cebb071bb0d381c41954f62c5a7bd53a720e03b9d48b8fed","available":true,"content_status":null} ## Complete dated records Availability observations: https://phishdestroy.io/domain/975126.com/records.json?source=availability&format=json Source observation history: https://phishdestroy.io/domain/975126.com/records.json?source=detections&format=json PhishStats records: https://phishdestroy.io/domain/975126.com/records.json?source=phishstats&format=json Sent report records: https://phishdestroy.io/domain/975126.com/records.json?source=sent_reports&format=json Report history: https://phishdestroy.io/domain/975126.com/records.json?source=report_history&format=json Repeat report records: https://phishdestroy.io/domain/975126.com/records.json?source=rereports&format=json Follow-up records: https://phishdestroy.io/domain/975126.com/records.json?source=followups&format=json Content observations: https://phishdestroy.io/domain/975126.com/records.json?source=content&format=json ## Dated availability observation Latest stored reachability observation ```json { "state": "alive", "label_key": "availability.active", "detail_key": "detail.latest_reachability", "params": [], "source": "current_http_probe", "record_id": 1866689, "scope": "checked_url", "observed_at": "2026-11-09T04:03:59Z", "http_status": 302, "http_observed_at": "2026-11-09T04:03:59Z", "stored_http_code": 302, "stored_http_observed_at": "2026-11-09T04:03:59Z", "legacy_site_status": "alive", "supports_outcome_badge": false, "content_classification": "unknown", "content_classification_at": "2026-11-09T00:26:03Z", "registration_state": "unknown", "policy": "20261102-dated-availability-v2" } ```