# PhishDestroy domain threat record: chromedosk-google.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/chromedosk-google.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/chromedosk-google.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 01:37:40 UTC
- Last availability or vendor check: 2026-10-22 10:27:07 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: 温州市中网计算机技术服务有限公司
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a151cd-5038-708d-b70f-bb129ae7498d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/chromedosk-google.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.chromedosk-google.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://chromedosk-google.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The domain chromedosk-google.com.cn mimics a Google Chrome download site, using the page title '谷歌浏览器-Google chrome下载网站' (Google Browser - Google Chrome download site). PhishDestroy first observed this domain on 2026-10-19, and as of that date the site was reported as unreachable despite still being live.

How the scam works
The page title indicates the site is presented as a legitimate Google Chrome download portal, likely aiming to trick users into downloading malicious installers or entering sensitive information. While the exact mechanism is not confirmed, domains impersonating trusted software brands often distribute trojans, steal credentials, or deliver malware that compromises user systems or wallets.

Evidence
VirusTotal scanned the domain on 2026-10-19 with 92 engines, returning 0 detections. Despite the absence of antivirus flags, the domain is listed on the PhishDestroy, MetaMask, and SEAL blocklists, and is referenced in 4 OTX pulses, indicating community-sourced suspicion.

Infrastructure
The domain was registered on 2026-10-17 with 温州市中网计算机技术服务有限公司. It is hosted on IP address 188.114.96.3.

What to do
Anyone who visited this site should scan their device for malware using a reputable antivirus tool and avoid downloading any files from the page. Users who entered any information should change passwords and monitor accounts for suspicious activity. Defenders should block the domain and IP at the network level and review logs for related traffic.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a151cd-5038-708d-b70f-bb129ae7498d/
VirusTotal report: https://www.virustotal.com/gui/domain/chromedosk-google.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=chromedosk-google.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 02:14:22 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/LDb5cFz9/c0fe15ddcfc6.png
  Captured: 2026-10-19 01:37:40 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a151cd-5038-708d-b70f-bb129ae7498d.png
  Captured: 2026-10-19 01:37:40 UTC
  Source report: https://urlscan.io/result/01a151cd-5038-708d-b70f-bb129ae7498d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ac5f6cc8-2211-4030-a60a-84f727ef30f5.png
  Captured: 2026-10-19 02:12:33 UTC
  Source report: https://radar.cloudflare.com/scan/ac5f6cc8-2211-4030-a60a-84f727ef30f5
  SHA-256: a1cc8ef46855354c69c03c338edf5c760974108a8f8e2c3273f89fed4ecd7cb5
- URLQuery: https://screenshots.phishdestroy.io/uq/86178f9a-caa1-4988-99b7-aa0930868b5a.png
  Source report: https://urlquery.net/report/86178f9a-caa1-4988-99b7-aa0930868b5a
  SHA-256: 03b64c36d1311059574b81484d11f172d63b07e617674d48b7bac158b03325a5
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15375-0eb5-767c-9537-e7a458c38a72.png
  Captured: 2026-10-19 09:19:10 UTC
  Source report: https://urlscan.io/result/01a15375-0eb5-767c-9537-e7a458c38a72/
  SHA-256: 6484e9b8aa3ec084a06f2e6fb1c6ef86440f263257aaaf3939f43f4ed5b2129d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:44:39Z",
        "uuid": "01a151cd-5038-708d-b70f-bb129ae7498d",
        "scanned_at": "2026-10-19T01:36:19Z",
        "final_url": "https://chromedosk-google.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://chromedosk-google.com.cn/",
                "from": "http://chromedosk-google.com.cn/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "ips": [
            "188.114.96.3"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.chromee-google.com",
            "chromeer-google.com.cn"
        ],
        "doc_hash": "9fa1f96738203e3f7d1fc13010aaa803b663b75401db8e89fe3793d6fe53878a",
        "script_hashes": [
            "7636c7cfbc03812ab660ea36167a52d9bb0fb15f4a97afe73416d9de15d5567d"
        ],
        "tls": {
            "san": [
                "*.chromedosk-google.com.cn",
                "chromedosk-google.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "chromedosk-google.com.cn",
            "protocol": "QUIC",
            "valid_to": "2027-01-15T16:17:05Z",
            "valid_from": "2026-10-17T16:17:06Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 3,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:56:00Z",
        "uuid": "ac5f6cc8-2211-4030-a60a-84f727ef30f5",
        "scanned_at": "2026-10-19T02:12:33Z",
        "final_url": "https://search.yahoo.com/",
        "status": 200,
        "history": [
            {
                "url": "https://chromedosk-google.com.cn/",
                "status": 200
            },
            {
                "url": "https://search.yahoo.com/",
                "status": 200
            }
        ],
        "dom_hash": "bc2a91ca0ea9bc4d8be478b1cbe30f69418ab7405097102f88f55df22624fc29",
        "doc_hash": "1216df8c50ec9a7f720308ac71268013c6a32d5b395e57f57ed0019d05a9663c",
        "domain_risks": [
            "Search Engines",
            "Technology"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "geo.yahoo.com",
                "type": "CNAME",
                "value": "geo-atsv2.media.g03.yahoodns.net"
            },
            {
                "name": "geo.yahoo.com",
                "type": "CNAME",
                "value": "geo-atsv2.media.g03.yahoodns.net"
            },
            {
                "name": "loc.yahoo.com",
                "type": "CNAME",
                "value": "edge.gycpi.b.yahoodns.net"
            },
            {
                "name": "loc.yahoo.com",
                "type": "CNAME",
                "value": "edge.gycpi.b.yahoodns.net"
            },
            {
                "name": "search.yahoo.com",
                "type": "CNAME",
                "value": "w6.search-aws-l7-prod.aws.yahoo.cloud"
            },
            {
                "name": "search.yahoo.com",
                "type": "CNAME",
                "value": "w6.search-aws-l7-prod.aws.yahoo.cloud"
            }
        ],
        "dnssec_valid": false,
        "ip": "63.32.180.52",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "1995-01-18T05:00:00Z",
            "updated": "2025-12-18T09:16:39Z",
            "expires": "2027-01-19T05:00:00Z",
            "nameservers": [
                "ns1.yahoo.com",
                "ns2.yahoo.com",
                "ns3.yahoo.com",
                "ns4.yahoo.com",
                "ns5.yahoo.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:07:07Z",
        "analysis_at": "2026-10-19T02:02:43Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 1,
            "suspicious": 3,
            "undetected": 37
        },
        "detections": {
            "CRDF": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "suspicious",
            "alphaMountain.ai": "spam"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Spam (alphaMountain.ai)"
        },
        "first_seen": "2026-10-17T17:21:52Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:cd16"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "colette.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:1685"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.205.22"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.22.133"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "seamus.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "colette.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-19T02:07:58Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.chromedosk-google.com.cn",
                "chromedosk-google.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "66b87ec65e95c8e044f75268b8cf4999578",
            "sha256": "388ac8a1e74b765f9365bb0bdf31c2f06bffb668c6a322e13b1ee208cf282ef7",
            "subject": "chromedosk-google.com.cn",
            "valid_to": "2027-01-15T16:17:05Z",
            "valid_from": "2026-10-17T16:17:06Z"
        },
        "whois": {
            "status": [
                "ok"
            ],
            "nameservers": [
                "colette.ns.cloudflare.com",
                "seamus.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T00:58:20Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "chromedosk-google.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-19T01:50:38Z",
            "first": "2026-10-19T01:50:38Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 6408
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true
        },
        "social_tags": {
            "title": "谷歌浏览器-Google chrome下载网站",
            "keywords": "Google Chrome, Chrome 下载, 极速浏览器, 安全浏览器, 谷歌浏览器, Chrome 官方下载, Windows 浏览器",
            "description": "谷歌浏览器（Google Chrome）官方下载页面提供由 Google 打造的快速、安全且免费的网页浏览器下载服务。该页面支持 Windows、macOS、Linux、Android 及 iOS 等多种操作系统，用户可根据设备自动匹配或手动选择对应的版本进行安装。Chrome 内置隐私控制与安全防护功能，并能与 Gmail、Google 日历等应用协同工作，提升浏览与办公效率。页面还提供详细的系统要求说明与离线安装指引，方便用户在各类设备上顺利获取并保持浏览器处于最新状态。"
        },
        "trackers": {
            "requests": 19,
            "trackers": [
                {
                    "name": "Yahoo!",
                    "company": "Yahoo",
                    "country": "US",
                    "category": "Site Analytics",
                    "requests": 19
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 10,
                "tls": 17,
                "wait": 404,
                "connect": 11,
                "download": 0
            },
            "response_ms": 442
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 18563,
            "co2_grams": 0.0007,
            "cleaner_than": 58
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.44.184",
                    "host": "seamus.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.38.28",
                    "host": "colette.ns.cloudflare.com"
                }
            ],
            "zone": "chromedosk-google.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "A1",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "A3",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "A1S",
                    "secure": true,
                    "session": true,
                    "same_site": "Lax"
                },
                {
                    "name": "_ebd",
                    "secure": true
                },
                {
                    "name": "sBS"
                },
                {
                    "name": "_dmit",
                    "same_site": "Lax"
                },
                {
                    "name": "_dmr",
                    "secure": true
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::9",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "chromedosk-google.com.cn"
        },
        "dns": {
            "A": [
                "188.114.96.9",
                "188.114.97.9"
            ],
            "NS": [
                "seamus.ns.cloudflare.com",
                "colette.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"colette.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417761418, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2a06:98c1:3121::9",
                "2a06:98c1:3120::9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::9",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://chromedosk-google.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "HTTP/3"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.chromee-google.com/",
                "https://chromeer-google.com.cn/"
            ],
            "external_count": 2,
            "internal_count": 1
        },
        "whois": {
            "registrar": "温州市中网计算机技术服务有限公司",
            "created": "2026-10-17T21:40:37Z",
            "expires": "2027-10-17T21:40:37Z",
            "status": [
                "ok"
            ],
            "nameservers": [
                "colette.ns.cloudflare.com",
                "seamus.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```