# PhishDestroy domain threat record: googleepway.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/googleepway.com/ Machine-readable companion: https://phishdestroy.io/domain/googleepway.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-28 00:49:57 UTC - Last availability or vendor check: 2026-10-28 00:49:57 UTC - Stored record updated: 2026-10-28 01:23:46 UTC - VirusTotal detections in the stored snapshot: 15/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: Phishunt - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 104.21.77.51 - Registrar in stored WHOIS data: GoDaddy.com, LLC - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2023-12-27 15:50:59 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17ffb-5208-7325-81d8-d1b312f1eda1/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/googleepway.com - Certificate Transparency search: https://crt.sh/?q=%25.googleepway.com - Web Archive lookup: https://web.archive.org/web/*/https://googleepway.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s intake AI classified the domain as malicious because it impersonates Google Play, displaying a Google logo and account‑management UI despite the unrelated domain name. The intake record notes “🦠 VT: 13 malicious vendors” as the trigger. The page was first observed by PhishDestroy on 2026-10-28, returned HTTP 200 and showed the title “Fortune Tiger OX Mouse PG – Apps no Google Play”. How the scam works In a typical Google Play phishing campaign the attacker hosts a look‑alike storefront that asks visitors to sign in with their Google credentials. Captured credentials can be reused to access the victim’s Google account, associated services and personal data. Evidence VirusTotal scanned the domain on 2026-10-28 (analysis date 2026-10-26) and reported 13 malicious and 2 suspicious detections from 92 engines, with vendors such as BitDefender, Fortinet, G‑Data and Sophos labeling it phishing. Google Safe Browsing checked on 2026-10-28 and did not flag the site. urlscan captured the page on 2026-10-05; its overall verdict was clean but its engine score of 88 marked it malicious. Cloudflare Radar scanned on 2026-10-28 and categorized the domain as phishing and malware. The external blocklist Phishunt lists the domain, PhishDestroy’s internal blocklist also contains it, and OTX shows three pulses referencing the domain as of 2026-10-28. Infrastructure The domain was registered with GoDaddy.com, LLC on 2023-12-27, giving it an age of over 1,000 days at the time of observation. DNS records on 2026-10-28 listed A addresses 172.67.204.167 and 104.21.77.51 and AAAA addresses 2606:4700:3037::6815:4d33 and 2606:4700:3037::ac43:cca7, with nameservers amit.ns.cloudflare.com and dalary.ns.cloudflare.com. The TLS certificate observed on 2026-10-28 was issued by Google Trust Services, valid until 2026-12-27, and the site was served through Cloudflare. What to do Anyone who entered Google credentials on this site should change their password immediately and enable two‑factor authentication. Defenders should add googleepway.com to web‑filter blocklists, monitor access logs for connections to the recorded IPs, and ensure no credential reuse occurs. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17ffb-5208-7325-81d8-d1b312f1eda1/ Cloudflare Radar report: https://radar.cloudflare.com/scan/0bd1a66c-e273-4cd0-82a6-f0db00baaf29 URLQuery report: https://urlquery.net/report/cb24c3c2-d5b0-431e-b9b6-3e652470ff45 Stored capture screenshot: https://i.ibb.co/7xCgQJY1/d1ccfc5e2357.png Cloudflare Radar screenshot (2026-10-28T01:20:51Z): https://screenshots.phishdestroy.io/cf/0bd1a66c-e273-4cd0-82a6-f0db00baaf29.png URLQuery screenshot: https://screenshots.phishdestroy.io/uq/cb24c3c2-d5b0-431e-b9b6-3e652470ff45.png URLScan screenshot (2025-12-15T16:02:29Z): https://screenshots.phishdestroy.io/us/019b22bf-8025-73fa-857c-5504bfa0488c.png URLScan capture report: https://urlscan.io/result/019b22bf-8025-73fa-857c-5504bfa0488c/ URLScan screenshot (2026-06-01T18:19:10Z): https://screenshots.phishdestroy.io/us/019e8469-10ea-719c-ac54-d7542edd23ca.png URLScan capture report: https://urlscan.io/result/019e8469-10ea-719c-ac54-d7542edd23ca/ URLScan screenshot (2026-07-31T05:02:16Z): https://screenshots.phishdestroy.io/us/019fb68d-0c4b-754a-aeb4-9340004e32c1.png URLScan capture report: https://urlscan.io/result/019fb68d-0c4b-754a-aeb4-9340004e32c1/ URLScan screenshot (2026-07-31T19:54:19Z): https://screenshots.phishdestroy.io/us/019fb9bd-d288-7435-8ed4-3d4ec3cb83bc.png URLScan capture report: https://urlscan.io/result/019fb9bd-d288-7435-8ed4-3d4ec3cb83bc/ URLScan screenshot (2026-09-28T03:39:23Z): https://screenshots.phishdestroy.io/us/01a0e618-60d1-70dd-a5e4-2de645d9ffd8.png URLScan capture report: https://urlscan.io/result/01a0e618-60d1-70dd-a5e4-2de645d9ffd8/ URLScan screenshot (2026-10-05T09:04:58Z): https://screenshots.phishdestroy.io/us/01a10b4e-fdbb-715c-952e-8b6b0f5f5e6b.png URLScan capture report: https://urlscan.io/result/01a10b4e-fdbb-715c-952e-8b6b0f5f5e6b/ VirusTotal report: https://www.virustotal.com/gui/domain/googleepway.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=googleepway.com Archived copy: https://web.archive.org/web/20261028004709/https://googleepway.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-28 01:22:06 UTC ## Stored page captures - Primary capture: https://i.ibb.co/7xCgQJY1/d1ccfc5e2357.png Captured: 2026-10-28 00:49:57 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a17ffb-5208-7325-81d8-d1b312f1eda1.png Captured: 2026-10-28 00:49:57 UTC Source report: https://urlscan.io/result/01a17ffb-5208-7325-81d8-d1b312f1eda1/ - URLScan · 2026-10-05: https://screenshots.phishdestroy.io/us/01a10b4e-fdbb-715c-952e-8b6b0f5f5e6b.png Captured: 2026-10-05 09:04:58 UTC Source report: https://urlscan.io/result/01a10b4e-fdbb-715c-952e-8b6b0f5f5e6b/ SHA-256: c9e0225cbeadd6f8645dc034d737d076ea96f026ab2e922b4c8a2a0fc61125af - URLScan · 2025-12-15: https://screenshots.phishdestroy.io/us/019b22bf-8025-73fa-857c-5504bfa0488c.png Captured: 2025-12-15 16:02:29 UTC Source report: https://urlscan.io/result/019b22bf-8025-73fa-857c-5504bfa0488c/ SHA-256: c97fa34c14150ac27f8dc482d04af2279f16393c319cf2800a4d2f65a872fc56 - URLScan · 2026-06-01: https://screenshots.phishdestroy.io/us/019e8469-10ea-719c-ac54-d7542edd23ca.png Captured: 2026-06-01 18:19:10 UTC Source report: https://urlscan.io/result/019e8469-10ea-719c-ac54-d7542edd23ca/ SHA-256: 8315f82c310c5a42f4daddbc7c323331c7f15204e3e9d882436da37e99e85b97 - URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb68d-0c4b-754a-aeb4-9340004e32c1.png Captured: 2026-07-31 05:02:16 UTC Source report: https://urlscan.io/result/019fb68d-0c4b-754a-aeb4-9340004e32c1/ SHA-256: 326f7832f96bda1e9a830e5902754ed1a45cf75807d7b61d9dfb0d30eb900465 - URLScan · 2026-07-31: https://screenshots.phishdestroy.io/us/019fb9bd-d288-7435-8ed4-3d4ec3cb83bc.png Captured: 2026-07-31 19:54:19 UTC Source report: https://urlscan.io/result/019fb9bd-d288-7435-8ed4-3d4ec3cb83bc/ SHA-256: 326f7832f96bda1e9a830e5902754ed1a45cf75807d7b61d9dfb0d30eb900465 - URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e618-60d1-70dd-a5e4-2de645d9ffd8.png Captured: 2026-09-28 03:39:23 UTC Source report: https://urlscan.io/result/01a0e618-60d1-70dd-a5e4-2de645d9ffd8/ SHA-256: c9e0225cbeadd6f8645dc034d737d076ea96f026ab2e922b4c8a2a0fc61125af - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0bd1a66c-e273-4cd0-82a6-f0db00baaf29.png Captured: 2026-10-28 01:20:51 UTC Source report: https://radar.cloudflare.com/scan/0bd1a66c-e273-4cd0-82a6-f0db00baaf29 SHA-256: 2db44de58291786fa873ff4c7333f678b3addd192cb34bdfffdb8e38574b74f2 - URLQuery: https://screenshots.phishdestroy.io/uq/cb24c3c2-d5b0-431e-b9b6-3e652470ff45.png Source report: https://urlquery.net/report/cb24c3c2-d5b0-431e-b9b6-3e652470ff45 SHA-256: c79b9786fad12d18aad9439243f8f2b28394ca82f5f6aaa6cd1fb3a895c37fc1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-28T00:55:25Z", "uuid": "01a17ffb-5208-7325-81d8-d1b312f1eda1", "scanned_at": "2026-10-28T00:49:09Z", "final_url": "https://googleepway.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://googleepway.com/", "from": "http://googleepway.com/", "status": 307 } ], "ip": "172.67.204.167", "domains": [ "analytics.tiktok.com", "www.facebook.com", "connect.facebook.net", "www.gstatic.com" ], "ips": [ "142.251.153.120", "157.240.0.35", "2.16.204.4", "57.144.244.128", "172.67.204.167" ], "asns": [ "15169", "32934", "20940", "13335" ], "countries": [ "US", "DE" ], "doc_hash": "7ed08fa35bcb4d4ca9ecd302bc49827622de7991621fccef2ed52ce0d35338d1", "script_hashes": [ "39d0410b039c6b17da1720a7ef1092eb9bf3bcc760ab292264cfeb4760601e84", "2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8" ], "globals": [ "appname", "apkPath", "appDesc", "fbq", "_fbq", "TiktokAnalyticsObject", "ttq", "GetRequest", "openGame", "showFav", "hideFav", "showShare", "hideShare", "openNew", "shareMe", "params", "apkurl" ], "cookies": [ "_ttp", "fr" ], "storage_keys": [ "tt_sessionId", "tt_pixel_session_index", "tt_appInfo" ], "tls": { "san": [ "googleepway.com", "*.googleepway.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "googleepway.com", "protocol": "QUIC", "valid_to": "2026-12-27T07:15:16Z", "valid_from": "2026-09-28T06:15:21Z" }, "domain_age_days": 1034, "apex_age_days": 1034, "tls_age_days": 29, "tls_valid_days": 90, "requests": 32, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 88, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=0" } }, "cf": { "v": 1, "fetched_at": "2026-10-28T01:21:39Z", "uuid": "0bd1a66c-e273-4cd0-82a6-f0db00baaf29", "scanned_at": "2026-10-28T01:20:51Z", "final_url": "https://googleepway.com/", "status": 200, "history": [ { "url": "https://googleepway.com/", "status": 200 } ], "dom_hash": "2e427f262f2b5131de0e50d1a40bea7b6851af098a889d7e0286591cefd596ff", "doc_hash": "71942989b2420f0e33f517510a5464e86f44a2c97bfc51b88a6619cb394aacfd", "phishing_v2": [ "phishing" ], "domain_risks": [ "Phishing", "Security threats", "Malware", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "googleepway.com", "type": "A", "value": "104.21.77.51" }, { "name": "googleepway.com", "type": "A", "value": "172.67.204.167" }, { "name": "googleepway.com", "type": "AAAA", "value": "2606:4700:3037::6815:4d33" }, { "name": "googleepway.com", "type": "AAAA", "value": "2606:4700:3037::ac43:cca7" } ], "dnssec_valid": false, "ip": "127.0.1.1", "verdict": { "tags": [ "phishing", "malware" ], "malicious": true, "categories": [ "phishing", "malware" ] }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2023-12-27T16:50:59Z", "updated": "2026-10-04T11:54:53Z", "expires": "2027-12-27T16:50:59Z", "nameservers": [ "amit.ns.cloudflare.com", "dalary.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-28T01:20:46Z", "analysis_at": "2026-10-25T23:52:13Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 13, "suspicious": 2, "undetected": 31 }, "detections": { "DNS8": "phishing", "ESET": "suspicious", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "malware", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Gambling, Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }, "registrar": "GoDaddy.com, LLC", "created": "2023-12-27T16:50:59Z", "expires": "2026-12-27T16:50:59Z", "updated": "2025-03-13T08:01:51Z", "first_seen": "2023-12-29T08:03:23Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "amit.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::ac43:cca7" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3037::6815:4d33" }, { "ttl": 21600, "type": "NS", "value": "dalary.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.77.51" }, { "ttl": 300, "type": "A", "value": "172.67.204.167" }, { "ttl": 21600, "type": "NS", "value": "amit.ns.cloudflare.com" } ], "dns_at": "2026-10-25T23:52:30Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "googleepway.com", "*.googleepway.com" ], "issuer": "Google Trust Services / WE1", "serial": "e6c5db5793d16aa0e4e6b7e6fe39fc5", "sha256": "ec52fdcfb9ed8f2fe7dd071757e289ff30b143c184c75e4d9de2d3be95f6cc53", "subject": "googleepway.com", "valid_to": "2026-12-27T07:15:16Z", "valid_from": "2026-09-28T06:15:21Z" }, "whois": { "registrar": "GoDaddy.com, LLC", "registrar_iana_id": "146", "registrar_url": "http://www.godaddy.com", "created": "2023-12-27T16:50:59Z", "updated": "2025-03-13T08:01:51Z", "expires": "2026-12-27T16:50:59Z", "status": [ "clientDeleteProhibited", "clientRenewProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "amit.ns.cloudflare.com", "dalary.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client delete prohibited", "client renew prohibited", "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2027-12-27T16:50:59Z", "last changed": "2026-10-04T11:54:53Z", "registration": "2023-12-27T16:50:59Z", "last update of RDAP database": "2026-10-25T23:51:59Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-28T01:16:29Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "googleepway.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-28T00:47:09Z", "first": "2024-12-17T15:19:05Z", "changes": 4, "days_archived": 5, "scans_per_day": 0.01, "avg_page_bytes": 14872 }, "social_tags": { "title": "Fortune Tiger OX Mouse PG - Apps no Google Play", "ogType": "website", "robots": "NOODP", "ogImage": "./static/picture/icon.png", "ogTitle": "Fortune Tiger OX Mouse PG - Apps no Google Play", "ogSiteName": "Google Play", "description": "Ao jogar seus jogos de caça-níqueis favoritos, você já desejou que o dinheiro crescesse em árvores? Bem, no Cash River Slots, o dinheiro realmente cresce em árvores! Se você quer uma fonte para os melhores jogos de caça-níqueis clássicos, caça-níqueis de vídeo, caça-níqueis VIP, caça-níqueis 777, jo", "twitterCard": "summary_large_image", "twitterSite": "@GooglePlay", "ogDescription": "Ao jogar seus jogos de caça-níqueis favoritos, você já desejou que o dinheiro crescesse em árvores? Bem, no Cash River Slots, o dinheiro realmente cresce em árvores! Se você quer uma fonte para os melhores jogos de caça-níqueis clássicos, caça-níqueis de vídeo, caça-níqueis VIP, caça-níqueis 777, jo" }, "trackers": { "requests": 26, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 2 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 2 }, { "name": "TikTok Analytics", "company": "ByteDance Inc", "country": "KY", "category": "Site Analytics", "requests": 2 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 293, "tls": 66, "wait": 430, "connect": 12, "download": 235 }, "response_ms": 1036 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 141140, "co2_grams": 0.0052, "cleaner_than": 14 }, "dns_server": { "ns": [ { "ip": "108.162.194.220", "host": "dalary.ns.cloudflare.com" }, { "ip": "173.245.59.63", "host": "amit.ns.cloudflare.com" } ], "zone": "googleepway.com" }, "cookies": { "cookies": [ { "name": "_ttp", "secure": true, "same_site": "None" } ] }, "location": { "ip": "2606:4700:3037::ac43:cca7", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "googleepway.com" }, "dns": { "A": [ "172.67.204.167", "104.21.77.51" ], "NS": [ "dalary.ns.cloudflare.com", "amit.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"amit.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416267113, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3037::ac43:cca7", "2606:4700:3037::6815:4d33" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=0", "message": "HSTS max-age is 0, below the 31536000 minimum." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=0", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3037::6815:4d33", "family": 6 }, "redirects": { "chain": [ "https://googleepway.com" ] }, "tech_stack": { "technologies": [ "TikTok Pixel", "Facebook Pixel", "core-js", "HSTS", "Cloudflare", "Open Graph", "HTTP/3" ] }, "social_presence": { "profiles": [ "https://x.com/GooglePlay" ] }, "linked_pages": { "internal_count": 1 }, "whois": { "registrar": "GoDaddy.com, LLC", "created": "2023-12-27T16:50:59Z", "updated": "2026-10-04T11:54:53Z", "expires": "2027-12-27T16:50:59Z", "status": [ "clientDeleteProhibited https://icann.org/epp", "clientRenewProhibited https://icann.org/epp", "clientTransferProhibited https://icann.org/epp", "clientUpdateProhibited https://icann.org/epp" ], "nameservers": [ "amit.ns.cloudflare.com", "dalary.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html", "strict-transport-security": "max-age=0" } } } } ```