# PhishDestroy domain threat record: keyboardescape1.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/keyboardescape1.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/keyboardescape1.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-14 04:15:19 UTC
- Last availability or vendor check: 2026-10-22 10:06:53 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 4/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 142.251.13.132
- Registrar in stored WHOIS data: Google Blogger
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09e21-c577-711d-b88c-3692f8190c8e/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/keyboardescape1.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.keyboardescape1.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://keyboardescape1.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
keyboardescape1.blogspot.com is a Blogger page titled "Speed Legends - Free Items" that impersonates the Speed Legends brand. It is aimed at players looking for free in-game rewards. PhishDestroy first saw it on 2026-09-14. When last checked on 2026-10-19, the site was still up and serving its content.

How the scam works
Free-item pages like this one use the promise of rare or premium game items to get players to act fast. These schemes usually ask the visitor to sign in with their game or platform account to "claim" the reward, which hands the login to the operator. Some send the visitor through download or verification steps instead. No items are ever delivered. The real loss is the account itself, along with any inventory, purchases or payment methods linked to it.

Evidence
Four of 91 VirusTotal engines flagged the page as of 2026-09-28: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet and LevelBlue. That count is low, so most browsers and security tools will not warn a visitor yet. PhishDestroy is currently the only blocklist listing it. The impersonation classification rests on the page presenting itself as an official Speed Legends free-items offer.

Infrastructure
The page is a free subdomain on Google Blogger, hosted on Google LLC's network in the US. It needs no domain registration, so whoever runs it can create a replacement in minutes after a takedown, likely under a similar name. The HTTPS certificate comes from Google Trust Services and is issued automatically to every Blogger site. The padlock in the address bar therefore says nothing about whether the page is genuine.

What to do
If you entered a username and password on this page, change that password right away, along with any other account that uses the same one. Turn on two-factor authentication and sign out of all active sessions. Check the account for changed email addresses, missing items or unfamiliar purchases. If you downloaded anything from the page, delete it and run a malware scan. Defenders should block this Blogger subdomain and report it to Google Blogger as impersonation. They should also tell players that real game rewards never require logging in through a third-party blog.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09e21-c577-711d-b88c-3692f8190c8e/
VirusTotal report: https://www.virustotal.com/gui/domain/keyboardescape1.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=keyboardescape1.blogspot.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:01 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09e21-c577-711d-b88c-3692f8190c8e.png
  Captured: 2026-09-14 04:15:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a09e21-c577-711d-b88c-3692f8190c8e.png
  Captured: 2026-09-24 03:30:30 UTC
  Source report: https://urlscan.io/result/01a09e21-c577-711d-b88c-3692f8190c8e/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/5f789c2e-ef16-4e9f-a331-ee07df594240.png
  Captured: 2026-09-21 07:56:27 UTC
  Source report: https://radar.cloudflare.com/scan/5f789c2e-ef16-4e9f-a331-ee07df594240
  SHA-256: 6804b0d323dbc861e21044190570949c9a584fa4802b4f0d41d12470f24f888c

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:22:48Z",
        "uuid": "01a09e21-c577-711d-b88c-3692f8190c8e",
        "scanned_at": "2026-09-14T04:16:55Z",
        "final_url": "https://keyboardescape1.blogspot.com/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://keyboardescape1.blogspot.com/",
                "from": "https://keyboardescape1.blogspot.com/",
                "status": 302
            }
        ],
        "ip": "2a00:1450:4001:c21::84",
        "domains": [
            "speeditems.pages.dev",
            "fonts.gstatic.com",
            "dtvpp42hfuyb2.cloudfront.net",
            "cdnjs.cloudflare.com",
            "cdn.tailwindcss.com",
            "static.cloudflareinsights.com",
            "fonts.googleapis.com",
            "d19k1sh57v5k0g.cloudfront.net"
        ],
        "ips": [
            "142.250.154.94",
            "2600:9000:2096:2a00:8:77df:b80:21",
            "142.251.127.132",
            "2606:4700::6810:4f49",
            "172.66.47.91",
            "2a00:1450:4001:c0f::5f",
            "2600:9000:213f:ea00:c:259f:e400:21",
            "104.17.24.14",
            "2606:4700:20::681a:38f",
            "2a00:1450:4001:c21::84"
        ],
        "asns": [
            "15169",
            "16509",
            "13335"
        ],
        "countries": [
            "US",
            "DE"
        ],
        "link_domains": [
            "www.blogger.com"
        ],
        "doc_hash": "2dfbc74038f6598bd08287daec331e2ea65c1dbcd52312eb704252ad30524da0",
        "script_hashes": [
            "068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568"
        ],
        "globals": [
            "tailwind",
            "LXJNU_zQN_Bbsjwc",
            "xfContentLocker",
            "__cfRLUnblockHandlers",
            "CPBContentLocker",
            "xfLock",
            "xfGetFeedURL",
            "xfGetIframeURL",
            "xfGetIframeHTML",
            "xfUnlock",
            "xfOfferComplete",
            "xfOffersComplete",
            "xfCheckForLead",
            "xfComplete",
            "CPABuildLock",
            "CPABuildGetFeedURL",
            "CPABuildGetIframeURL",
            "CPABuildGetIframeHTML",
            "CPABuildUnlock",
            "CPABuildOfferComplete",
            "CPABuildOffersComplete",
            "CPABuildCheckForLead",
            "CPABuildComplete",
            "_RH",
            "_Vm",
            "_uj",
            "_Ew",
            "_HW",
            "_oy",
            "_Jf",
            "_Mz",
            "_EQ",
            "_ZU",
            "_lL",
            "_yk",
            "_Tm",
            "_Ht",
            "_nS",
            "_Xy",
            "_qr"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T08:38:52Z",
            "valid_from": "2026-08-10T08:38:53Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 34,
        "tls_valid_days": 83,
        "requests": 31,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:57Z",
        "uuid": "5f789c2e-ef16-4e9f-a331-ee07df594240",
        "scanned_at": "2026-09-21T07:56:27Z",
        "final_url": "https://keyboardescape1.blogspot.com/",
        "status": 200,
        "history": [
            {
                "url": "https://keyboardescape1.blogspot.com/",
                "status": 200
            }
        ],
        "dom_hash": "ae0fb75805b87b9d53f9afa89e3f2d41a6d8ff6e4dc7164174de8844dc3547cd",
        "doc_hash": "c1cb74ee5cb0b89c0284ff0534520f9aeb698ba2fc6879b93ae2d3cff1352d6d",
        "domain_risks": [
            "Gaming",
            "Entertainment"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "keyboardescape1.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "keyboardescape1.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.251.218.97",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T01:54:02Z",
        "analysis_at": "2026-10-02T12:31:40Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 4,
            "suspicious": 0,
            "undetected": 37
        },
        "detections": {
            "Fortinet": "phishing",
            "LevelBlue": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "MarkMonitor Inc.",
        "created": "2000-07-31T21:38:58Z",
        "expires": "2027-07-31T21:38:58Z",
        "updated": "2026-06-29T10:34:06Z",
        "first_seen": "2026-09-14T04:15:16Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "74.125.69.132"
            },
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2607:f8b0:4001:c08::84"
            }
        ],
        "dns_at": "2026-10-02T12:32:03Z",
        "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c",
        "cert": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "issuer": "Google Trust Services / WR2",
            "serial": "2d0b6afb07a0733d0aa16a004aada7e6",
            "sha256": "4aa135fc6b20dd1adaf18c08ff529d335260c9f9c6fa793c06d94c031abb38a5",
            "subject": "misc-sni.blogspot.com",
            "valid_to": "2026-12-03T19:23:02Z",
            "valid_from": "2026-09-10T19:23:03Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2000-07-31T07:00:00Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited",
                "serverDeleteProhibited",
                "serverTransferProhibited",
                "serverUpdateProhibited"
            ],
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```