# PhishDestroy domain threat record: lewan-google.com.cn

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/lewan-google.com.cn/
Machine-readable companion: https://phishdestroy.io/domain/lewan-google.com.cn/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 01:49:03 UTC
- Last availability or vendor check: 2026-10-22 10:29:38 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 1/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 172.247.153.86
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-17 11:04:43 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a151d7-d445-77c4-8ae9-f332755e44bf/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/lewan-google.com.cn
- Certificate Transparency search: https://crt.sh/?q=%25.lewan-google.com.cn
- Web Archive lookup: https://web.archive.org/web/*/https://lewan-google.com.cn/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
The domain lewan-google.com.cn is being used as an impersonation phishing page that pretends to be a Google service. It targets Google account holders by mimicking the look of a legitimate login portal. PhishDestroy first recorded the site on 2026-10-19. The site is still alive but its content was unreachable when last checked on 2026-10-19.

How the scam works
Visitors are presented with a page titled "LEWIN·乐玩(中国区)官方网站-Global Platform" that hides a Google login form behind the branding. When a victim enters their Google email and password, the credentials are captured by the attackers. The stolen login data can be used to hijack the account, reset passwords, or bypass two‑factor authentication. In some cases the page may also request additional verification codes, further compromising the account.

Evidence
VirusTotal flagged the domain once out of 92 scanning engines, with alphaMountain.ai providing the detection. PhishDestroy, MetaMask and SEAL have all listed the site on their blocklists. OTX reports four pulses referencing the domain. No additional detections from Google Safe Browsing, urlscan.io or Spamhaus are available at this time.

Infrastructure
The domain’s registrar information is not publicly available. Hosting is provided from IP 172.247.153.86 on the POWERLINE-AS-AP network operated by Power Line Datacenter in Hong Kong. The TLS certificate is issued by Let’s Encrypt (YE1), indicating the site uses a free, automated certificate. The lack of registrar data and the use of a reputable certificate authority suggest a low‑cost, quickly deployed operation.

What to do
Anyone who entered Google credentials on this page should immediately change their password, enable or review two‑factor authentication, and inspect recent account activity for unauthorized access. Revoke any unknown third‑party app permissions from the Google security settings. Security teams should block lewan-google.com.cn at the network perimeter, add it to internal phishing blocklists, and monitor for any related phishing attempts targeting Google users.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a151d7-d445-77c4-8ae9-f332755e44bf/
VirusTotal report: https://www.virustotal.com/gui/domain/lewan-google.com.cn
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=lewan-google.com.cn
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 13:20:02 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/LDb5cFz9/c0fe15ddcfc6.png
  Captured: 2026-10-19 01:49:03 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a151d7-d445-77c4-8ae9-f332755e44bf.png
  Captured: 2026-10-19 01:49:03 UTC
  Source report: https://urlscan.io/result/01a151d7-d445-77c4-8ae9-f332755e44bf/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c0d7ed05-16f2-4cdc-a32b-02fbeb57fd87.png
  Captured: 2026-10-19 01:51:31 UTC
  Source report: https://radar.cloudflare.com/scan/c0d7ed05-16f2-4cdc-a32b-02fbeb57fd87
  SHA-256: 8bad985f8eede46081619ab1b35360d50689ede275773cde08d89fac748798da
- URLQuery: https://screenshots.phishdestroy.io/uq/9a509ef5-4e29-4d13-b2e2-431b574b53a5.png
  Source report: https://urlquery.net/report/9a509ef5-4e29-4d13-b2e2-431b574b53a5
  SHA-256: 139d73765d35da607d608ca9457a96a27f292340ae9b56279cf2badabc42189d
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151ce-9f66-77f1-84c9-67ebdca1b27b.png
  Captured: 2026-10-19 01:37:59 UTC
  Source report: https://urlscan.io/result/01a151ce-9f66-77f1-84c9-67ebdca1b27b/
  SHA-256: c99d063b795dec23cd208fab562628132713cc4ee521658a785fb63b1b98542f
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151e0-d429-75ca-bf4e-8bcc1fef11e1.png
  Captured: 2026-10-19 01:57:40 UTC
  Source report: https://urlscan.io/result/01a151e0-d429-75ca-bf4e-8bcc1fef11e1/
  SHA-256: 0f01d8b230502c85709bd393a7be91594a5f6e786e9e133d068e72f227b1304d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:44:30Z",
        "uuid": "01a151d7-d445-77c4-8ae9-f332755e44bf",
        "scanned_at": "2026-10-19T01:47:50Z",
        "final_url": "https://lewan-google.com.cn/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://lewan-google.com.cn/",
                "from": "http://lewan-google.com.cn/",
                "status": 307
            }
        ],
        "ip": "172.247.153.86",
        "domains": [
            "cdnjs.cloudflare.com",
            "hm.baidu.com",
            "rb9177.com",
            "rb3289.com",
            "ue6906.com",
            "ue1912.com",
            "lwhuzi.com",
            "lw1616.com",
            "th6241.com",
            "wj1903.com",
            "qmjiayu.com",
            "qm8051.com",
            "qy3507.com",
            "qycion.com",
            "jx1638.com",
            "jx3256.com"
        ],
        "ips": [
            "111.45.3.198",
            "104.17.25.14",
            "172.247.153.86"
        ],
        "asns": [
            "9808",
            "13335",
            "132839"
        ],
        "countries": [
            "CN",
            "US"
        ],
        "link_domains": [
            "qyh999.com",
            "qyh918.com",
            "jx3256.com",
            "qycion.com",
            "qm8051.com",
            "wj1903.com",
            "lw1616.com",
            "ue1912.com",
            "rb3289.com"
        ],
        "doc_hash": "2b1920937f9799201b3de8e8b46f169d12d06d6f89a3daf89e7661f74469f4fc",
        "script_hashes": [
            "8b6ece88d70bc66f013605a8159a70330f48deb1202829cee5ac2b1cf3f1ba41",
            "c2f08c6fa47856571612fefb3a780eb2d9fe18eff9c3609d65bf64b31c3bbf65",
            "900fb11afa49e0dabb267232438aad19b736d52bee903fab08008b582c755524",
            "8cc4e1ed293f6a11601fb6345e546410af306a0d30b9ad9dbd0a8ebbe8c9e051"
        ],
        "globals": [
            "_hmt",
            "_bdhm_loaded_bf8061ca73eaa705ec626f7edd51c901",
            "mini_tangram_log_94a5mj"
        ],
        "cookies": [
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "HMACCOUNT",
            "HMACCOUNT_BFESS",
            "Hm_lvt_329a636047682dfecc9be43978082a1e",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e"
        ],
        "storage_keys": [
            "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
            "HMACCOUNT",
            "Hm_unsent_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901",
            "Hm_lpvt_329a636047682dfecc9be43978082a1e",
            "Hm_unsent_329a636047682dfecc9be43978082a1e",
            "Hm_lvt_329a636047682dfecc9be43978082a1e"
        ],
        "tls": {
            "san": [
                "lewan-google.com.cn",
                "m.lewan-google.com.cn",
                "www.lewan-google.com.cn"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "lewan-google.com.cn",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-13T04:36:55Z",
            "valid_from": "2026-10-15T04:36:56Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 3,
        "tls_valid_days": 89,
        "requests": 45,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:55:58Z",
        "uuid": "c0d7ed05-16f2-4cdc-a32b-02fbeb57fd87",
        "scanned_at": "2026-10-19T01:51:31Z",
        "final_url": "https://lewan-google.com.cn/",
        "status": 200,
        "history": [
            {
                "url": "https://lewan-google.com.cn/",
                "status": 200
            }
        ],
        "dom_hash": "ea200d2cb5130e6b6f86e567b3e7c2d591ed03c3b59481242e043d8c007d00a4",
        "doc_hash": "2b1920937f9799201b3de8e8b46f169d12d06d6f89a3daf89e7661f74469f4fc",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "lewan-google.com.cn",
                "type": "A",
                "value": "172.247.153.86"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.247.153.86",
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T15:04:43Z",
            "expires": "2027-09-17T15:04:43Z",
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:07:02Z",
        "analysis_at": "2026-10-19T03:01:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 51,
            "malicious": 2,
            "suspicious": 2,
            "undetected": 37
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "suspicious",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "first_seen": "2026-10-15T09:43:04Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "admin.nowcndns.com",
                "value": "ns1.nowcndns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "172.247.153.86"
            }
        ],
        "dns_at": "2026-10-19T03:07:11Z",
        "jarm": "40d40d40d00040d00043d43d00043d3bef2bf79cd6719851e8198c1e8f9a14",
        "cert": {
            "san": [
                "lewan-google.com.cn",
                "m.lewan-google.com.cn",
                "www.lewan-google.com.cn"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "5a509ce1e261302c00491a01f8abef806ad",
            "sha256": "92414949ce8717d81f47e598b4cf32d3279f443ff86b538929dc77e3f4172253",
            "subject": "lewan-google.com.cn",
            "valid_to": "2027-01-13T04:36:55Z",
            "valid_from": "2026-10-15T04:36:56Z"
        },
        "whois": {
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns1.nowcndns.com",
                "ns2.nowcndns.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T00:55:43Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "domain": "lewan-google.com.cn"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-19T01:54:06Z",
            "first": "2026-10-19T01:54:06Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 14990
        },
        "robots_txt": {
            "agents": [
                "*"
            ],
            "present": true,
            "sitemaps": [
                "https://lewan-google.com.cn/sitemap.xml"
            ]
        },
        "sitemap": {
            "present": true,
            "url_count": 8
        },
        "social_tags": {
            "ogUrl": "//lewan-google.com.cn/",
            "title": "LEWIN·乐玩(中国区)官方网站-Global Platform",
            "author": "LEWIN·乐玩(中国区)官方网站-Global Platform编辑部",
            "ogType": "website",
            "robots": "index,follow,max-image-preview:large,max-snippet:-1,max-video-preview:-1",
            "ogTitle": "LEWIN·乐玩(中国区)官方网站-Global Platform",
            "keywords": "乐玩lewin,乐玩.LEWIN乐玩",
            "ogSiteName": "LEWIN·乐玩(中国区)官方网站-Global Platform",
            "description": "乐玩lewin,乐玩.LEWIN乐玩,集团我们对会员承诺的履行永远都被我们视为成功的关键！",
            "twitterCard": "summary_large_image",
            "canonicalUrl": "//lewan-google.com.cn/",
            "ogDescription": "乐玩lewin,乐玩.LEWIN乐玩,集团我们对会员承诺的履行永远都被我们视为成功的关键！"
        },
        "trackers": {
            "requests": 42,
            "trackers": [
                {
                    "name": "Baidu Ads",
                    "company": "Baidu",
                    "country": "CN",
                    "category": "Advertising",
                    "requests": 4
                },
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 3
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 405,
                "tls": 248,
                "wait": 240,
                "connect": 619,
                "download": 236
            },
            "response_ms": 1748
        },
        "tls_connection": {
            "cipher": "TLS_AES_128_GCM_SHA256",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443
            ]
        },
        "carbon": {
            "bytes": 40049,
            "co2_grams": 0.0015,
            "cleaner_than": 42
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "218.98.111.129",
                    "host": "ns1.nowcndns.com"
                },
                {
                    "ip": "183.253.57.202",
                    "host": "ns2.nowcndns.com"
                }
            ],
            "zone": "lewan-google.com.cn"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "HMACCOUNT_BFESS",
                    "secure": true,
                    "same_site": "None"
                },
                {
                    "name": "Hm_lvt_bf8061ca73eaa705ec626f7edd51c901"
                },
                {
                    "name": "Hm_lpvt_bf8061ca73eaa705ec626f7edd51c901",
                    "session": true
                },
                {
                    "name": "HMACCOUNT",
                    "session": true
                },
                {
                    "name": "Hm_lvt_329a636047682dfecc9be43978082a1e"
                },
                {
                    "name": "Hm_lpvt_329a636047682dfecc9be43978082a1e",
                    "session": true
                }
            ]
        },
        "location": {
            "ip": "172.247.153.86",
            "asn": "132839",
            "org": "POWER LINE (HK) CO., LIMITED",
            "city": "Los Angeles",
            "country": "US"
        },
        "ssl": {
            "issuer": "Let's Encrypt / YE1",
            "subject": "lewan-google.com.cn"
        },
        "dns": {
            "A": [
                "172.247.153.86"
            ],
            "NS": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ],
            "SOA": "{\"nsname\": \"ns1.nowcndns.com\", \"hostmaster\": \"admin.nowcndns.com\", \"serial\": 1792032716, \"refresh\": 3600, \"retry\": 300, \"expire\": 1209600, \"minttl\": 1800}"
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "get_ip": {
            "ip": "172.247.153.86",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://lewan-google.com.cn"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Cloudflare",
                "Baidu Analytics (百度统计)",
                "Font Awesome",
                "cdnjs",
                "Open Graph"
            ]
        },
        "linked_pages": {
            "internal_count": 15
        },
        "whois": {
            "registrar": "广东时代互联科技有限公司",
            "created": "2026-09-17T13:04:43Z",
            "expires": "2027-09-17T13:04:43Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "ns2.nowcndns.com",
                "ns1.nowcndns.com"
            ]
        },
        "headers": {
            "headers": {
                "content-type": "text/html; charset=utf-8"
            }
        }
    }
}
```