# PhishDestroy domain threat record: encryptdrive.booogle.net

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/encryptdrive.booogle.net/
Machine-readable companion: https://phishdestroy.io/domain/encryptdrive.booogle.net/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 17:58:34 UTC
- Last availability or vendor check: 2026-10-25 17:58:34 UTC
- Stored record updated: 2026-10-25 20:49:51 UTC
- VirusTotal detections in the stored snapshot: 5/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google drive

## Stored infrastructure

- Observed IP address: 188.114.96.3
- Registrar in stored WHOIS data: Megazone Corp., dba HOSTING.KR
- Registrar country in stored WHOIS data: KR
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2006-09-18 07:57:26 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17435-7167-70b6-aa4f-8c8139ce7e49/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/encryptdrive.booogle.net
- Certificate Transparency search: https://crt.sh/?q=%25.encryptdrive.booogle.net
- Web Archive lookup: https://web.archive.org/web/*/https://encryptdrive.booogle.net/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake analysis identified encryptdrive.booogle.net as an impersonation of Google Drive that asks visitors to log in and grant access, a classic credential‑phishing pattern. The analysis noted the typo‑squatted domain "booogle.net" as a clear attempt to resemble "google.net". The page title reads "Encrypt, Decrypt files with Drive" and the recorded excerpt shows a login prompt. The domain was first seen by PhishDestroy on 2026-10-25 and the HTTP request on that date returned a 200 status code.

How the scam works
In this type of scheme the attacker hosts a site that looks like a legitimate cloud‑storage service and lures users to enter their Google credentials or authorize the app, thereby harvesting login details. By using a misspelled domain the attacker relies on visual similarity to trick users.

Evidence
VirusTotal scanned the domain on 2026-10-14 and reported five malicious detections out of ninety‑two engines, with vendors Webroot, Seclookup, Gridinsoft, Chong Lua Dao and alphaMountain.ai flagging it. Google Safe Browsing checked on 2026-10-25 did not flag the URL. urlscan.io captured the site on 2026-10-25; its machine‑learning engine marked it malicious with a score of 26 while the overall verdict was neutral. OTX listed zero pulses on the same day. PhishDestroy’s internal blocklist contains the domain, while external blocklists showed no entries at the time of checking.

Infrastructure
The site resolved to the IP address 188.114.96.3, hosted on the CloudFLARENET‑EU network and recorded in Great Britain. TLS was provided by Google Trust Services, with a certificate covering booogle.net and its subdomains, valid from 2026-10-01 to 2026-12-30. The domain has been registered for roughly 2811 days.

What to do
Anyone who entered Google credentials on this site should immediately change their password, enable two‑factor authentication, and review recent account activity for unauthorized access. Organizations should block encryptdrive.booogle.net at the firewall or DNS level and monitor logs for connections to the recorded IP address.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a17435-7167-70b6-aa4f-8c8139ce7e49/
Cloudflare Radar report: https://radar.cloudflare.com/scan/78342414-e6e6-4102-8d20-aac796e649ab
URLQuery report: https://urlquery.net/report/1ccdfc56-6009-4e8d-bae9-954dd2202847
Stored capture screenshot: https://i.ibb.co/r2dSsG6M/74c15250748d.png
Cloudflare Radar screenshot (2026-10-25T18:30:07Z): https://screenshots.phishdestroy.io/cf/78342414-e6e6-4102-8d20-aac796e649ab.png
URLQuery screenshot: https://screenshots.phishdestroy.io/uq/1ccdfc56-6009-4e8d-bae9-954dd2202847.png
VirusTotal report: https://www.virustotal.com/gui/domain/encryptdrive.booogle.net
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=encryptdrive.booogle.net
Archived copy: https://web.archive.org/web/20261025175923/https://encryptdrive.booogle.net/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 18:31:14 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/r2dSsG6M/74c15250748d.png
  Captured: 2026-10-25 17:58:34 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a17435-7167-70b6-aa4f-8c8139ce7e49.png
  Captured: 2026-10-25 17:58:34 UTC
  Source report: https://urlscan.io/result/01a17435-7167-70b6-aa4f-8c8139ce7e49/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/78342414-e6e6-4102-8d20-aac796e649ab.png
  Captured: 2026-10-25 18:30:07 UTC
  Source report: https://radar.cloudflare.com/scan/78342414-e6e6-4102-8d20-aac796e649ab
  SHA-256: 2e9ec380537693b0a6cae9bc2c5d517b587d49d5fcace8912c936092b2631c34
- URLQuery: https://screenshots.phishdestroy.io/uq/1ccdfc56-6009-4e8d-bae9-954dd2202847.png
  Source report: https://urlquery.net/report/1ccdfc56-6009-4e8d-bae9-954dd2202847
  SHA-256: 9f0137f4ada3a0585a66a7792e2279551603fdd442e55e7c86f43c6759e6e813

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T18:30:23Z",
        "uuid": "01a17435-7167-70b6-aa4f-8c8139ce7e49",
        "scanned_at": "2026-10-25T17:57:09Z",
        "final_url": "https://encryptdrive.booogle.net/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://encryptdrive.booogle.net/",
                "from": "http://encryptdrive.booogle.net/",
                "status": 307
            }
        ],
        "ip": "188.114.97.3",
        "domains": [
            "fundingchoicesmessages.google.com",
            "apis.google.com",
            "pagead2.googlesyndication.com",
            "iblogbox.github.io",
            "ajax.googleapis.com"
        ],
        "ips": [
            "142.251.14.139",
            "142.251.20.101",
            "142.250.154.155",
            "185.199.110.153",
            "142.251.110.95",
            "188.114.97.3"
        ],
        "asns": [
            "15169",
            "54113",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "drive.google.com"
        ],
        "doc_hash": "a4d40385a2f6ed6adabacd1699ade47579ca72b65afefcd8089967dfc7d02cf8",
        "script_hashes": [
            "de8902a9ac9f84bd5b31ff552735635830141b8765352e56f3edfa07869334b9"
        ],
        "globals": [
            "$",
            "jQuery",
            "setCookie",
            "getCookie",
            "_getid",
            "trim",
            "html_entity_encode",
            "shortstring",
            "cutstringmiddle",
            "messagetimer",
            "show_message",
            "hide_message",
            "setstorage",
            "getstorage",
            "fillnumber",
            "datetimetostring",
            "hexcase",
            "b64pad",
            "hex_md5",
            "b64_md5",
            "any_md5",
            "hex_hmac_md5",
            "b64_hmac_md5",
            "any_hmac_md5",
            "md5_vm_test",
            "rstr_md5",
            "rstr_hmac_md5",
            "rstr2hex",
            "rstr2b64",
            "rstr2any",
            "str2rstr_utf8",
            "str2rstr_utf16le",
            "str2rstr_utf16be",
            "rstr2binl",
            "binl2rstr",
            "binl_md5",
            "md5_cmn",
            "md5_ff",
            "md5_gg",
            "md5_hh"
        ],
        "cookies": [
            "FCCDCF"
        ],
        "storage_keys": [
            "gd_folder_id",
            "gd_folder_name",
            "gapi.sessionStorageTest"
        ],
        "tls": {
            "san": [
                "booogle.net",
                "*.booogle.net"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "booogle.net",
            "protocol": "QUIC",
            "valid_to": "2026-12-30T22:39:38Z",
            "valid_from": "2026-10-01T21:41:04Z"
        },
        "domain_age_days": 2811,
        "apex_age_days": 3194,
        "tls_age_days": 23,
        "tls_valid_days": 90,
        "requests": 23,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 26,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T18:30:35Z",
        "uuid": "78342414-e6e6-4102-8d20-aac796e649ab",
        "scanned_at": "2026-10-25T18:30:07Z",
        "final_url": "https://encryptdrive.booogle.net/",
        "status": 200,
        "history": [
            {
                "url": "https://encryptdrive.booogle.net/",
                "status": 200
            }
        ],
        "dom_hash": "c64e72e108ff3a0ae4deca98f932e9e397b28866b25938a69476171815540266",
        "doc_hash": "a4d40385a2f6ed6adabacd1699ade47579ca72b65afefcd8089967dfc7d02cf8",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "encryptdrive.booogle.net",
                "type": "A",
                "value": "172.66.43.48"
            },
            {
                "name": "encryptdrive.booogle.net",
                "type": "A",
                "value": "172.66.40.208"
            },
            {
                "name": "encryptdrive.booogle.net",
                "type": "AAAA",
                "value": "2606:4700:3108::ac42:2b30"
            },
            {
                "name": "encryptdrive.booogle.net",
                "type": "AAAA",
                "value": "2606:4700:3108::ac42:28d0"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.66.43.48",
        "whois": {
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "created": "2006-09-18T09:57:26Z",
            "updated": "2025-12-20T18:47:25Z",
            "expires": "2029-09-18T09:57:26Z",
            "nameservers": [
                "bob.ns.cloudflare.com",
                "jacqueline.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T18:29:58Z",
        "analysis_at": "2026-10-14T11:49:49Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 5,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "Webroot": "malicious",
            "Seclookup": "malicious",
            "Gridinsoft": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "malicious"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Information Technology, Phishing (alphaMountain.ai)"
        },
        "registrar": "Megazone Corp., dba HOSTING.KR",
        "created": "2006-09-18T12:00:00Z",
        "expires": "2029-09-18T09:57:26Z",
        "updated": "2025-12-21T12:00:00Z",
        "first_seen": "2023-10-13T17:43:29Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3108::ac42:28d0"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.66.43.48"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3108::ac42:2b30"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.66.40.208"
            }
        ],
        "dns_at": "2026-10-14T11:50:01Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "booogle.net",
                "*.booogle.net"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "61572745c94bf9a60e6593dc49153c31",
            "sha256": "7b8cdd6aaf401e026a88d84a8d53614ab8d0e6a7c61b6833b9d9b147efa142fe",
            "subject": "booogle.net",
            "valid_to": "2026-12-30T22:39:38Z",
            "valid_from": "2026-10-01T21:41:04Z"
        },
        "whois": {
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "registrar_iana_id": "1489",
            "registrar_url": "http://HOSTING.KR",
            "created": "2006-09-18T09:57:26Z",
            "updated": "2025-12-20T18:47:25Z",
            "expires": "2029-09-18T12:00:00Z",
            "status": [
                "clientTransferProhibited",
                "ok"
            ],
            "nameservers": [
                "bob.ns.cloudflare.com",
                "jacqueline.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T18:30:57Z",
        "caa_records": {
            "domain": "encryptdrive.booogle.net"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T17:59:23Z",
            "first": "2015-02-03T03:38:17Z",
            "changes": 44,
            "days_archived": 195,
            "scans_per_day": 0.05,
            "avg_page_bytes": 16099
        },
        "social_tags": {
            "ogUrl": "//encryptdrive.booogle.net/",
            "title": "Encrypt, Decrypt files with Drive",
            "ogType": "website",
            "ogImage": "//encryptdrive.booogle.net/img/logo128.png",
            "ogTitle": "Encrypt, Decrypt files with Drive",
            "keywords": "encrypt for google drive, decrypt for google drive, encryption file, decryption file, aes algorithms, encryption for drive, decryption for drive, cloud file encryption, cloud decryption",
            "description": "This is a file encryption and decryption tool for Google Drvie and your local files. It allows you to encrypt your files so that no one can look at them. This app uses powerful encryption algorithms (Encrypt/Decrypt any file using AES with 128 bit key).",
            "ogDescription": "This is a file encryption and decryption tool for Google Drvie and your local files. It allows you to encrypt your files so that no one can look at them. This app uses powerful encryption algorithms (Encrypt/Decrypt any file using AES with 128 bit key)."
        },
        "trackers": {
            "requests": 71,
            "trackers": [
                {
                    "name": "Google",
                    "company": "Google",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 6
                },
                {
                    "name": "Google Adsense",
                    "company": "Google",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 5
                },
                {
                    "name": "Google Marketing Platform",
                    "company": "Google",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 16
                },
                {
                    "name": "Google Syndication",
                    "company": "Google",
                    "country": "US",
                    "category": "Advertising",
                    "requests": 20
                },
                {
                    "name": "Github Pages",
                    "company": "GitHub, Inc.",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "Google APIs",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 8
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 9
                },
                {
                    "name": "Google Recaptcha",
                    "company": "Google",
                    "country": "US",
                    "category": "Utilities",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://iblogbox.github.io/js/encryptdrive/all.js",
                "https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js",
                "https://pagead2.googlesyndication.com/pagead/show_ads.js",
                "https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js"
            ],
            "third_party_scripts": 4
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 5,
                "tls": 14,
                "wait": 617,
                "connect": 6,
                "download": 260
            },
            "response_ms": 902
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 60161,
            "co2_grams": 0.0022,
            "cleaner_than": 33
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.33.104",
                    "host": "bob.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.194.132",
                    "host": "jacqueline.ns.cloudflare.com"
                }
            ],
            "zone": "booogle.net"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "__gads",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "__gpi",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "__eoi",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "IDE",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "APC",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "suid",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "ruds",
                    "secure": true,
                    "session": true,
                    "same_site": "None"
                },
                {
                    "name": "euds",
                    "secure": true,
                    "session": true,
                    "same_site": "None"
                },
                {
                    "name": "rud",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "eud",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "mlcwc",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "DSID",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "__cf_bm",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "FCCDCF"
                },
                {
                    "name": "_auid",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "_gu",
                    "secure": true,
                    "http_only": true,
                    "same_site": "None"
                },
                {
                    "name": "FCNEC"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3120::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "booogle.net"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3120::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://encryptdrive.booogle.net"
            ]
        },
        "linked_pages": {
            "internal_count": 1
        },
        "whois": {
            "registrar": "Megazone Corp., dba HOSTING.KR",
            "created": "2006-09-18T09:57:26Z",
            "updated": "2025-12-20T18:47:25Z",
            "expires": "2029-09-18T09:57:26Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp"
            ],
            "nameservers": [
                "bob.ns.cloudflare.com",
                "jacqueline.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```