# PhishDestroy domain threat record: docs-google.one

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/docs-google.one/
Machine-readable companion: https://phishdestroy.io/domain/docs-google.one/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 01:27:37 UTC
- Last availability or vendor check: 2026-10-22 10:27:33 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: openai

## Stored infrastructure

- Observed IP address: 162.159.143.30
- Registrar in stored WHOIS data: Porkbun
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-10-15 11:51:51 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a151d7-cbf5-7759-84d3-02dc7fb362cb/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/docs-google.one
- Certificate Transparency search: https://crt.sh/?q=%25.docs-google.one
- Web Archive lookup: https://web.archive.org/web/*/https://docs-google.one/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
docs-google.one is a phishing site that pretends to be a Google Docs page. It targets users of Google services by attempting to harvest their login credentials. PhishDestroy first recorded the domain on 2026-10-19. The site is still alive but its content was unreachable when last checked on 2026-10-19.

How the scam works
The page displays an empty document titled “Untitled Document” and immediately asks the visitor to sign in with a Google account. The login form is a replica of Google’s authentication page, so entered usernames, passwords and any two‑factor codes are captured by the attackers. With those credentials the criminals can access the victim’s Google account, email, Drive files and any linked services.

Evidence
VirusTotal flagged the domain in 2 of 92 scanners, with CRDF and Gridinsoft reporting it as malicious. PhishDestroy, MetaMask and SEAL have added the domain to their blocklists, and three OTX pulses reference it. The low number of detections still confirms its phishing nature.

Infrastructure
The domain was registered on 2026-10-15 through Porkbun, only four days before PhishDestroy’s first sighting. It is hosted behind Cloudflare’s network (IP 162.159.143.30) in Canada, which masks the true server location. The TLS certificate is issued by Google Trust Services / WE1, giving the site a legitimate‑looking HTTPS lock.

What to do
Anyone who entered a Google username, password or 2FA code on docs-google.one should immediately change their Google password and enable or refresh two‑factor authentication. Review recent account activity and revoke any unknown third‑party app permissions. Security teams should block the domain at the DNS and proxy level, add it to phishing blocklists, and monitor for any credential‑stuffing attempts using harvested accounts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a151d7-cbf5-7759-84d3-02dc7fb362cb/
VirusTotal report: https://www.virustotal.com/gui/domain/docs-google.one
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=docs-google.one
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 13:20:04 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/0ptkp0Wg/d9607d3ba12d.png
  Captured: 2026-10-19 01:48:59 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a151d7-cbf5-7759-84d3-02dc7fb362cb.png
  Captured: 2026-10-19 01:48:59 UTC
  Source report: https://urlscan.io/result/01a151d7-cbf5-7759-84d3-02dc7fb362cb/
- URLScan capture 2: https://urlscan.io/screenshots/01a146a7-ce1b-73c2-ba6d-cdd76820b59f.png
  Captured: 2026-10-19 01:27:37 UTC
  Source report: https://urlscan.io/result/01a151d7-cbf5-7759-84d3-02dc7fb362cb/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/feeda114-d6a7-43b1-a65e-9813553691fb.png
  Captured: 2026-10-19 01:31:43 UTC
  Source report: https://radar.cloudflare.com/scan/feeda114-d6a7-43b1-a65e-9813553691fb
  SHA-256: 1e77e66cd7c27fe56fe8545f4de51ef2d7dc4f0d4fecc49690948186e4e4cce1
- URLQuery: https://screenshots.phishdestroy.io/uq/328c9f33-c3b7-4d26-a518-74c466bd5b14.png
  Source report: https://urlquery.net/report/328c9f33-c3b7-4d26-a518-74c466bd5b14
  SHA-256: 4ac4d3cda976780606c95b3d764d48a09068aa2b3f64312466f61f40c56abe5c
- URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a146a7-ce1b-73c2-ba6d-cdd76820b59f.png
  Captured: 2026-10-16 21:39:34 UTC
  Source report: https://urlscan.io/result/01a146a7-ce1b-73c2-ba6d-cdd76820b59f/
  SHA-256: aa0c44e40e107deee659ab6c326dea6e9fb7c0edcf0a351870207af3452c3479
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151cd-f0b8-77cb-bc77-a84d45c84ff2.png
  Captured: 2026-10-19 01:37:00 UTC
  Source report: https://urlscan.io/result/01a151cd-f0b8-77cb-bc77-a84d45c84ff2/
  SHA-256: 74ce87ed5d88c3577e080abdfb22d77f53217eaf7505617ac23362407c67c881

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:44:50Z",
        "uuid": "01a151d7-cbf5-7759-84d3-02dc7fb362cb",
        "scanned_at": "2026-10-19T01:47:45Z",
        "final_url": "https://docs-google.one/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://docs-google.one/",
                "from": "http://docs-google.one/",
                "status": 307
            }
        ],
        "ip": "172.66.3.26",
        "ips": [
            "172.66.3.26"
        ],
        "asns": [
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "68f9dbb184eb591e4680723431f79e2250ea836acc506e6c76b350e707718f65",
        "script_hashes": [
            "760902232477603dd8870387d07bd48869e54353f925aba355e67f9d53dcb909",
            "580ad8c58061a4dde99bde0a56905e382f0568516ee2f5b84dbfb52085709021",
            "64b19b6b695d4a29b12f2cfda47d7ad2ee8b4c0ba092ee3b1c431cd906d7d623",
            "8f92bd8e3e17a3db35d1699776b21dfed5eec6234f4bc0276846f68636ff8e76",
            "bc5c1ff91aedf9034e0e761372ffe491d6c0d2a08dab36f53655af8ad00d28a2",
            "5093a3189f5438792ca271cfb4e4afb3d4928518e127d3b253ad3decff437176",
            "7d0029a878659d9ba04bf385bfb4d1ad01601767b2d20409e99e885115256608"
        ],
        "globals": [
            "__vite_rsc_client_require__",
            "__vite_rsc_require__",
            "next",
            "__VINEXT_RSC_BOOTSTRAP_STATE__",
            "__VINEXT_LINK_PREFETCH_ROUTES__",
            "__VINEXT_PAGES_LINK_PREFETCH_ROUTES__",
            "__VINEXT_CLIENT_REWRITES__",
            "__VINEXT_LOCALES__",
            "__VINEXT_RSC_ROOT__",
            "__zod_globalConfig",
            "__zod_globalRegistry",
            "__VINEXT_HYDRATED_AT",
            "__NEXT_HYDRATED",
            "__NEXT_HYDRATED_AT"
        ],
        "cookies": [
            "__Host-appgarden-visitor",
            "cf_clearance",
            "__cf_bm"
        ],
        "tls": {
            "san": [
                "docs-google.one"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "docs-google.one",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T15:42:52Z",
            "valid_from": "2026-10-15T14:42:54Z"
        },
        "domain_age_days": 2,
        "apex_age_days": 2,
        "tls_age_days": 3,
        "tls_valid_days": 90,
        "requests": 13,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:56:02Z",
        "uuid": "feeda114-d6a7-43b1-a65e-9813553691fb",
        "scanned_at": "2026-10-19T01:31:43Z",
        "final_url": "https://docs-google.one/",
        "status": 200,
        "history": [
            {
                "url": "https://docs-google.one/",
                "status": 200
            }
        ],
        "dom_hash": "0f27277e00b36791e7836c5117f68b99a63d7fc263851752096095d160d41649",
        "doc_hash": "618944216b3706bd9bf415e8e94d8dc26f72481f6a69fa7658bd367a6903c185",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "docs-google.one",
                "type": "A",
                "value": "162.159.143.30"
            },
            {
                "name": "docs-google.one",
                "type": "A",
                "value": "172.66.3.26"
            }
        ],
        "dnssec_valid": false,
        "ip": "162.159.143.30",
        "whois": {
            "registrar": "Porkbun",
            "created": "2026-10-15T13:51:51Z",
            "updated": "2026-10-15T13:52:15Z",
            "expires": "2027-10-15T13:51:51Z",
            "nameservers": [
                "curitiba.ns.porkbun.com",
                "fortaleza.ns.porkbun.com",
                "maceio.ns.porkbun.com",
                "salvador.ns.porkbun.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:07:12Z",
        "analysis_at": "2026-10-17T16:37:23Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 1,
            "suspicious": 1,
            "undetected": 37
        },
        "detections": {
            "CRDF": "malicious",
            "Gridinsoft": "suspicious"
        },
        "reputation": 0,
        "registrar": "Porkbun",
        "created": "2026-10-15T13:51:51Z",
        "expires": "2027-10-15T13:51:51Z",
        "updated": "2026-10-15T13:52:15Z",
        "first_seen": "2026-10-17T09:15:50Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "curitiba.ns.porkbun.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "162.159.143.30"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "fortaleza.ns.porkbun.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "172.66.3.26"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "salvador.ns.porkbun.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "maceio.ns.porkbun.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "curitiba.ns.porkbun.com"
            }
        ],
        "dns_at": "2026-10-17T16:55:39Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "docs-google.one"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "464d574fd440394b0ebb0aacd2585afe",
            "sha256": "3816e7de1a622de3d1fab593d069021f259c42669f0387b23a59e510a7dd8167",
            "subject": "docs-google.one",
            "valid_to": "2027-01-13T15:42:52Z",
            "valid_from": "2026-10-15T14:42:54Z"
        },
        "whois": {
            "registrar": "Porkbun",
            "registrar_iana_id": "1861",
            "registrar_url": "www.porkbun.com",
            "created": "2026-10-15T13:51:51Z",
            "updated": "2026-10-15T13:52:15Z",
            "expires": "2027-10-15T13:51:51Z",
            "status": [
                "addPeriod",
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "curitiba.ns.porkbun.com",
                "fortaleza.ns.porkbun.com",
                "maceio.ns.porkbun.com",
                "salvador.ns.porkbun.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "transfer prohibited",
                "delete prohibited"
            ],
            "events": {
                "expiration": "2027-10-15T13:51:51Z",
                "last changed": "2026-10-15T13:51:51Z",
                "registration": "2026-10-15T13:51:51Z",
                "registrar expiration": "2027-10-15T13:51:51Z",
                "last update of RDAP database": "2026-10-15T13:51:51Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T01:01:15Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "docs-google.one"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-19T01:39:55Z",
            "first": "2026-10-16T01:13:20Z",
            "changes": 1,
            "days_archived": 2,
            "scans_per_day": 0.33,
            "avg_page_bytes": 3568
        },
        "social_tags": {
            "title": "Untitled Document",
            "description": "Extemporaneous speech preparation."
        },
        "trackers": {
            "requests": 12
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 10,
                "tls": 12,
                "wait": 154,
                "connect": 6,
                "download": 1
            },
            "response_ms": 183
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 14941,
            "co2_grams": 0.0005,
            "cleaner_than": 63
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "162.159.11.180",
                    "host": "maceio.ns.porkbun.com"
                },
                {
                    "ip": "162.159.10.150",
                    "host": "salvador.ns.porkbun.com"
                },
                {
                    "ip": "173.245.58.37",
                    "host": "curitiba.ns.porkbun.com"
                },
                {
                    "ip": "162.159.8.140",
                    "host": "fortaleza.ns.porkbun.com"
                }
            ],
            "zone": "docs-google.one"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__Host-appgarden-visitor",
                    "secure": true,
                    "http_only": true,
                    "same_site": "Lax"
                },
                {
                    "name": "cf_clearance",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "__cf_bm",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                }
            ]
        },
        "location": {
            "ip": "162.159.143.30",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "docs-google.one"
        },
        "dns": {
            "A": [
                "172.66.3.26",
                "162.159.143.30"
            ],
            "NS": [
                "fortaleza.ns.porkbun.com",
                "curitiba.ns.porkbun.com",
                "maceio.ns.porkbun.com",
                "salvador.ns.porkbun.com"
            ],
            "SOA": "{\"nsname\": \"curitiba.ns.porkbun.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2417564658, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "172.66.3.26",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://docs-google.one"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "React",
                "Next.js",
                "Cloudflare Bot Management",
                "Priority Hints",
                "Cloudflare",
                "Webpack"
            ]
        },
        "whois": {
            "registrar": "Porkbun",
            "created": "2026-10-15T13:51:51Z",
            "updated": "2026-10-20T13:51:54Z",
            "expires": "2027-10-15T13:51:51Z",
            "status": [
                "clientDeleteProhibited https://icann.org/epp",
                "clientTransferProhibited https://icann.org/epp",
                "serverTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "curitiba.ns.porkbun.com",
                "salvador.ns.porkbun.com",
                "fortaleza.ns.porkbun.com",
                "maceio.ns.porkbun.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```