# PhishDestroy domain threat record: gardenowo.live

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/gardenowo.live/
Machine-readable companion: https://phishdestroy.io/domain/gardenowo.live/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-27 19:45:39 UTC
- Last availability or vendor check: 2026-10-28 00:31:16 UTC
- Stored record updated: 2026-10-28 00:31:16 UTC
- VirusTotal detections in the stored snapshot: 16/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored infrastructure

- Observed IP address: 172.67.219.176
- Registrar in stored WHOIS data: Dynadot Inc
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-07-24 14:16:37 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a17ef0-2eb8-7569-beeb-fca95f36e942/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/gardenowo.live
- Certificate Transparency search: https://crt.sh/?q=%25.gardenowo.live
- Web Archive lookup: https://web.archive.org/web/*/https://gardenowo.live/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy listed gardenowo.live on 2026-10-27 after Google Safe Browsing flagged it for social‑engineering. The recorded page title reads "Blog ogrodniczy gardenowo.live - porady ogrodnicze od 2012". A page fetch on 2026-10-27 returned HTTP 200, while a urlscan capture on 2026-09-23 reported HTTP 403 and a malicious verdict.

How the scam works
The detections classify the site as a phishing or social‑engineering resource, which typically tries to trick visitors into revealing login credentials, personal data or other sensitive information. No credential‑harvesting form or malicious payload was observed in the captured page.

Evidence
Google Safe Browsing on 2026-10-27 marked the domain as SOCIAL_ENGINEERING. VirusTotal analysis on 2026-10-22 reported 16 detections from 92 engines, including 13 malicious and 3 suspicious labels from vendors such as BitDefender, ESET and G‑Data. urlscan.io captured the site on 2026-09-23 and returned a malicious verdict with a score of 100, categorising it as phishing. Cloudflare Radar on 2026-10-27 also returned a malicious verdict and listed malware as a category. PhishDestroy’s internal blocklist flags the domain; external blocklists showed zero hits except a single block by Cloudflare Family.

Infrastructure
The domain was registered on 2026-07-24 through Dynadot Inc, with transfer prohibited and expiration set for 2027-07-24. It is served via Cloudflare, using the recorded IPv4 addresses 104.21.45.229 and 172.67.219.176 and IPv6 addresses 2606:4700:3037::6815:2de5 and 2606:4700:3031::ac43:dbb0, recorded in Canada. TLS is provided by Google Trust Services, valid from 2026-09-21 to 2026-12-20, and the domain uses Cloudflare nameservers fay.ns.cloudflare.com and jacob.ns.cloudflare.com without DNSSEC.

What to do
Visitors should avoid entering any credentials or personal information on the site and change passwords if they suspect they may have been entered. Organizations can add gardenowo.live to web filtering and DNS blocklists and monitor outbound connections to the listed Cloudflare IPs. Security teams should review access logs for interactions with this domain and enforce multi‑factor authentication for affected accounts.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0cdec-d041-75fa-a2ca-c2322c7f66d8/
Cloudflare Radar report: https://radar.cloudflare.com/scan/ca320712-491d-4039-92c3-1fcf8e730f10
Stored capture screenshot: https://urlscan.io/screenshots/01a0cdec-d041-75fa-a2ca-c2322c7f66d8.png
Cloudflare Radar screenshot (2026-10-27T19:48:23Z): https://screenshots.phishdestroy.io/cf/ca320712-491d-4039-92c3-1fcf8e730f10.png
URLScan screenshot (2026-09-22T19:00:51Z): https://screenshots.phishdestroy.io/us/01a0ca7d-7b1c-73b3-a651-515556e5ca09.png
URLScan capture report: https://urlscan.io/result/01a0ca7d-7b1c-73b3-a651-515556e5ca09/
VirusTotal report: https://www.virustotal.com/gui/domain/gardenowo.live
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=gardenowo.live
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-27 19:51:47 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a17ef0-2eb8-7569-beeb-fca95f36e942.png
  Captured: 2026-10-27 19:59:13 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0cdec-d041-75fa-a2ca-c2322c7f66d8.png
  Captured: 2026-10-27 19:45:39 UTC
  Source report: https://urlscan.io/result/01a17ef0-2eb8-7569-beeb-fca95f36e942/
- URLScan · 2026-09-22: https://screenshots.phishdestroy.io/us/01a0ca7d-7b1c-73b3-a651-515556e5ca09.png
  Captured: 2026-09-22 19:00:51 UTC
  Source report: https://urlscan.io/result/01a0ca7d-7b1c-73b3-a651-515556e5ca09/
  SHA-256: 050d9556b7c6776d9ca38a9b59fb647ad82410b187654915da197c8606f36684
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/ca320712-491d-4039-92c3-1fcf8e730f10.png
  Captured: 2026-10-27 19:48:23 UTC
  Source report: https://radar.cloudflare.com/scan/ca320712-491d-4039-92c3-1fcf8e730f10
  SHA-256: fa2ce28e1e799050897bc680ec7ebc35c917739af9851cd65ed013648c18aad0
- URLQuery: https://screenshots.phishdestroy.io/uq/3c699b8d-3d2d-4e7a-9b63-1ca6c457a309.png
  Source report: https://urlquery.net/report/3c699b8d-3d2d-4e7a-9b63-1ca6c457a309
  SHA-256: b99466c2d7f8073a8fd40285de32b5254444420c3f379d9b24a1ea517fa328de
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cdec-d041-75fa-a2ca-c2322c7f66d8.png
  Captured: 2026-09-23 11:01:20 UTC
  Source report: https://urlscan.io/result/01a0cdec-d041-75fa-a2ca-c2322c7f66d8/
  SHA-256: 649c44caedc307ea2f0dba8802643bd8765f4a9f2e2bde93b31ffefff33652f4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-27T20:30:46Z",
        "uuid": "01a17ef0-2eb8-7569-beeb-fca95f36e942",
        "scanned_at": "2026-10-27T19:57:32Z",
        "final_url": "https://gardenowo.live/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://gardenowo.live/",
                "from": "http://gardenowo.live/",
                "status": 307
            },
            {
                "to": "http://gardenowo.live/",
                "from": "https://gardenowo.live/",
                "status": 307
            },
            {
                "to": "https://gardenowo.live/",
                "from": "http://gardenowo.live/",
                "status": 307
            }
        ],
        "ip": "2606:4700:3037::6815:2de5",
        "domains": [
            "d3bo67muzbfgtl.cloudfront.net",
            "www.googletagmanager.com",
            "region1.analytics.google.com",
            "stats.g.doubleclick.net",
            "www.gardenowo.live",
            "www.google.de",
            "www.google.com",
            "www.google-analytics.com",
            "connect.facebook.net",
            "ad.doubleclick.net",
            "www.clarity.ms",
            "fonts.googleapis.com"
        ],
        "ips": [
            "216.239.34.36",
            "142.251.127.154",
            "142.251.20.97",
            "142.251.127.94",
            "2001:4860:4802:34::36",
            "2a00:1450:4001:c21::9c",
            "142.251.14.149",
            "142.251.154.119",
            "2a00:1450:4001:c15::65",
            "18.244.20.45",
            "4.153.187.221",
            "157.240.0.6",
            "2a00:1450:4001:c17::61",
            "172.67.219.176",
            "2a00:1450:4001:c25::5f"
        ],
        "asns": [
            "15169",
            "16509",
            "8075",
            "32934",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "www.facebook.com",
            "www.gardenowo.live"
        ],
        "social": [
            "https://www.facebook.com/Gardenowopl-879991448783151"
        ],
        "doc_hash": "d63d986d64563a77d948ebd43cb308c948bbd250eb17393371f430c00997b097",
        "script_hashes": [
            "07b90321ebbdd9ee0883df2b989c2a4e8e29d3576163a32d76b66c5baf017836"
        ],
        "globals": [
            "Prototype",
            "Abstract",
            "Try",
            "Class",
            "PeriodicalExecuter",
            "Template",
            "$break",
            "Enumerable",
            "$A",
            "$w",
            "$H",
            "Hash",
            "$R",
            "ObjectRange",
            "Ajax",
            "$",
            "Form",
            "Field",
            "$F",
            "Toggle",
            "Insertion",
            "$continue",
            "Position",
            "validateCreditCard",
            "Validator",
            "Validation",
            "removeDelimiters",
            "parseNumber",
            "Effect",
            "Autocompleter",
            "Control",
            "popWin",
            "setLocation",
            "setPLocation",
            "setLanguageCode",
            "decorateGeneric",
            "decorateTable",
            "decorateList",
            "decorateDataList",
            "parseSidUrl"
        ],
        "cookies": [
            "fp_ccid",
            "fp_sid",
            "_gcl_au",
            "_gid",
            "_dc_gtm_UA-35943185-1",
            "_gat_UA-35943185-1",
            "_ga_1DK04C02KK",
            "_ga",
            "_fbp",
            "_ga_V4QE9T67RR"
        ],
        "storage_keys": [
            "~~~",
            "edroneCanUseCookie",
            "cId",
            "recommended_data:6790e0d598d22",
            "recommended_data",
            "_gcl_ls",
            "lastExternalReferrer",
            "lastExternalReferrerTime"
        ],
        "tls": {
            "san": [
                "gardenowo.live",
                "*.gardenowo.live"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gardenowo.live",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-20T19:02:51Z",
            "valid_from": "2026-09-21T18:03:02Z"
        },
        "domain_age_days": 95,
        "apex_age_days": 95,
        "tls_age_days": 36,
        "tls_valid_days": 90,
        "requests": 119,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-27T19:51:06Z",
        "uuid": "ca320712-491d-4039-92c3-1fcf8e730f10",
        "scanned_at": "2026-10-27T19:48:23Z",
        "final_url": "https://gardenowo.live/",
        "status": 200,
        "history": [
            {
                "url": "https://gardenowo.live/",
                "status": 200
            }
        ],
        "dom_hash": "5c58079d33ec7b0fa832340f22a07762166c99d5b8c2ff2678a5019eebb06088",
        "doc_hash": "3450b7fd85da0ce5fba316229dd7225b92167bd85c7b1390a81cfb5e46efeaf4",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Malware",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "gardenowo.live",
                "type": "A",
                "value": "104.21.45.229"
            },
            {
                "name": "gardenowo.live",
                "type": "A",
                "value": "172.67.219.176"
            },
            {
                "name": "gardenowo.live",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2de5"
            },
            {
                "name": "gardenowo.live",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:dbb0"
            },
            {
                "name": "www.gardenowo.live",
                "type": "A",
                "value": "104.21.45.229"
            },
            {
                "name": "www.gardenowo.live",
                "type": "A",
                "value": "172.67.219.176"
            },
            {
                "name": "www.gardenowo.live",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2de5"
            },
            {
                "name": "www.gardenowo.live",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:dbb0"
            }
        ],
        "dnssec_valid": false,
        "ip": "127.0.1.19",
        "verdict": {
            "tags": [
                "malware"
            ],
            "malicious": true,
            "categories": [
                "malware"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-27T19:47:28Z",
        "analysis_at": "2026-10-22T07:11:54Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 3,
            "undetected": 32
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Bfore.Ai PreCrime": "malicious",
            "Google Safe Browsing": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-07-24T17:10:38Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.45.229"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:dbb0"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "fay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.219.176"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "fay.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:2de5"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jacob.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-22T07:45:37Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "gardenowo.live",
                "*.gardenowo.live"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "397c42691764d9980e99fe47289c509",
            "sha256": "b1d96f3182aba944d0d3dcdbd8362cb33cf757f9724687a695a6fb059ef9f4ed",
            "subject": "gardenowo.live",
            "valid_to": "2026-12-20T19:02:51Z",
            "valid_from": "2026-09-21T18:03:02Z"
        },
        "rdap": {
            "status": [
                "transfer prohibited"
            ],
            "events": {
                "expiration": "2027-07-24T16:16:37Z",
                "last changed": "2026-07-24T16:19:16Z",
                "registration": "2026-07-24T16:16:37Z",
                "registrar expiration": "2027-07-24T16:16:37Z",
                "last update of RDAP database": "2026-10-20T08:11:58Z"
            },
            "registrar": "DYNADOT LLC",
            "registrar_iana_id": "472"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-27T19:51:27Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "gardenowo.live"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "archives": {
            "last": "2026-10-27T19:49:15Z",
            "first": "2026-10-27T19:49:15Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 31540
        },
        "robots_txt": {
            "agents": [
                "Googlebot-Image",
                "*"
            ],
            "present": true
        },
        "sitemap": {
            "present": true,
            "url_count": 2991
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "108.162.192.115",
                    "host": "fay.ns.cloudflare.com"
                },
                {
                    "ip": "162.159.44.162",
                    "host": "jacob.ns.cloudflare.com"
                }
            ],
            "zone": "gardenowo.live"
        },
        "location": {
            "ip": "2606:4700:3037::6815:2de5",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Toronto",
            "country": "CA"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "gardenowo.live"
        },
        "dns": {
            "A": [
                "104.21.45.229",
                "172.67.219.176"
            ],
            "NS": [
                "jacob.ns.cloudflare.com",
                "fay.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"fay.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418021356, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "AAAA": [
                "2606:4700:3037::6815:2de5",
                "2606:4700:3031::ac43:dbb0"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2606:4700:3031::ac43:dbb0",
            "family": 6
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html"
            }
        }
    }
}
```