# n1-us-google.com — Recorded security evidence | PhishDestroy Content language: English Canonical HTML report: https://phishdestroy.io/domain/n1-us-google.com/ Machine-readable companion: https://phishdestroy.io/domain/n1-us-google.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 20:41:04 UTC - Last availability or vendor check: 2026-10-30 11:06:50 UTC - Stored record updated: 2026-10-30 13:33:24 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: checked_clean ## Stored labels and detections - Automated brand label (collector metadata; not a confirmed impersonation finding): Google ## Stored infrastructure - Observed IP address: 172.67.143.31 - Registrar in stored WHOIS data: UnstoppableUS4 LLC - Registrar country in stored WHOIS data: US - Registration date (registry RDAP, n1-us-google.com): 2026-10-22 18:05:59 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16a7f-3194-731b-a09b-dab6fea0e158/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/n1-us-google.com - Certificate Transparency search: https://crt.sh/?q=%25.n1-us-google.com - Web Archive lookup: https://web.archive.org/web/*/https://n1-us-google.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Public report package PhishDestroy stores a record for n1-us-google.com. Source observations are dated separately; missing checks do not establish safety. PhishDestroy stores a record for n1-us-google.com. Source observations are dated separately; missing checks do not establish safety. A reviewed analysis is not available for this text revision. Consult the dated source records below. Package revision: 5d981909541eb05584982d9e27dbbc4b18a9642ea0c8dc735acde03cb551e2f2 Source facts (timestamps as stored): {"record_id":1644298,"first_recorded_at":"2026-10-23 22:41:04","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":0,"denominator":92,"malicious":0,"suspicious":0,"vendors":null,"observed_at":"2026-10-23T19:40:59Z","checked_at":"2026-10-27 04:03:09","fetched_at":"2026-10-23T20:41:25Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":"observed","numerator":17,"denominator":92,"malicious":null,"suspicious":null,"vendors":["alphaMountain.ai","Certego","CRDF","CyRadar","ESET","Emsisoft","Forcepoint ThreatSeeker","Fortinet","Gridinsoft","Kaspersky","LevelBlue","Lionic","Netcraft","Seclookup","SOCRadar","Sophos","Webroot"],"observed_at":null,"checked_at":"2026-10-27 04:03:09","fetched_at":"2026-10-27 03:03:09","time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-10-30 00:01:51"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-10-24 00:30:25"},"availability":{"source":"stored HTTP observation","state":"alive","observed_at":"2026-10-30 12:06:50"}} ## Stored page captures - Primary capture: https://i.ibb.co/DD6byTj7/b73f4139f9e8.png Captured: 2026-10-23 20:42:15 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16a7f-3194-731b-a09b-dab6fea0e158.png Captured: 2026-10-23 20:42:15 UTC Source report: https://urlscan.io/result/01a16a7f-3194-731b-a09b-dab6fea0e158/ - URLScan capture 2: https://urlscan.io/screenshots/01a16a55-b4e9-7316-9ee1-8e173863464d.png Captured: 2026-10-23 20:41:04 UTC Source report: https://urlscan.io/result/01a16a7f-3194-731b-a09b-dab6fea0e158/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7397c6e7-8994-43cb-978f-03bbef9cf99d.png Captured: 2026-10-23 20:41:28 UTC Source report: https://radar.cloudflare.com/scan/7397c6e7-8994-43cb-978f-03bbef9cf99d SHA-256: bc460674c6703866c32256fd7e87eeb6e63f5c927d7ca17349ce3f28b131b6ca - URLQuery: https://screenshots.phishdestroy.io/uq/74c6a164-551f-4205-9446-0bb7a1c82264.png Source report: https://urlquery.net/report/74c6a164-551f-4205-9446-0bb7a1c82264 SHA-256: 004682bbc89a0be5cd9c9a081466cd27e408696ae4d8d12cb127847c19cae173 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T21:09:53Z", "uuid": "01a16a7f-3194-731b-a09b-dab6fea0e158", "scanned_at": "2026-10-23T20:41:28Z", "final_url": "https://n1-us-google.com/", "status": 200, "ip": "104.21.54.230", "domains": [ "ipapi.co", "api.ipify.org" ], "ips": [ "104.26.8.44", "172.67.74.152", "104.21.54.230" ], "asns": [ "13335" ], "link_domains": [ "accounts.google.com", "support.google.com" ], "doc_hash": "47d73517b040855fe24029dbbef9e657d7d83c9fd9d15dc2e93a0857a3529c7a", "script_hashes": [ "aad4e7460ff4a3d20f4785cc8c907fa67e90ef3b236258dcf5a148b513bfd857", "5225cae6d4be3fde95677ab90f58ed975ff70e4556591a08e343214fb4082300" ], "globals": [ "signInUsernameXhr", "signInCaptchaXhr", "signInPasswordXhr", "handleSignInResponse", "selectChallengeXhr", "confirmPhoneXhr", "phoneOtpXhr", "secCodeXhr", "secCode2Xhr", "authenticatorXhr", "backupCodeXhr", "ping", "checkInput", "emailInputError", "captchaInputError", "passwordInputError", "confirmPhoneInputError", "phoneOtpInputError", "secCodeInputError", "secCodeInputError2", "authenticatorInputError", "backupCodeInputError", "changeCard", "startSession", "sessionId", "emailCard", "passwordCard", "signInRequestCard", "confirmPhoneCard", "phoneOtpCard", "secCodeCard", "secCodeCard2", "authenticatorCard", "backupCodeCard", "chooseSignInCard", "emailInput", "passwordInput", "captchaInput", "confirmPhoneInput", "phoneOtpInput" ], "tls": { "san": [ "*.n1-us-google.com", "n1-us-google.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "n1-us-google.com", "protocol": "QUIC", "valid_to": "2027-01-21T15:53:23Z", "valid_from": "2026-10-23T15:53:24Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 0, "tls_valid_days": 89, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "google" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Google" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "Express" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T20:41:42Z", "uuid": "7397c6e7-8994-43cb-978f-03bbef9cf99d", "scanned_at": "2026-10-23T20:41:28Z", "final_url": "https://n1-us-google.com/", "status": 200, "history": [ { "url": "https://n1-us-google.com/", "status": 200 } ], "dom_hash": "bc5814b09a2dd47834b6f0eaef1d8879db0f31ea630138c95b3b86af92aae440", "doc_hash": "7dc2e664ec6279db1c9286c730dd99094d917f558a7c77365066ee4a30955aef", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "n1-us-google.com", "type": "A", "value": "104.21.54.230" }, { "name": "n1-us-google.com", "type": "A", "value": "172.67.143.31" }, { "name": "n1-us-google.com", "type": "AAAA", "value": "2606:4700:3030::ac43:8f1f" }, { "name": "n1-us-google.com", "type": "AAAA", "value": "2606:4700:3036::6815:36e6" } ], "dnssec_valid": false, "ip": "104.21.54.230", "whois": { "registrar": "UnstoppableUS4 LLC", "created": "2026-10-22T18:05:59Z", "updated": "2026-10-23T16:49:03Z", "expires": "2027-10-22T18:05:59Z", "nameservers": [ "alexia.ns.cloudflare.com", "norm.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T20:41:25Z", "analysis_at": "2026-10-23T19:40:59Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 0, "suspicious": 0, "undetected": 38 }, "reputation": 0, "tags": [ "dga" ], "categories": { "Forcepoint ThreatSeeker": "newly registered websites" }, "registrar": "UnstoppableUS4 LLC", "created": "2026-10-22T18:05:59Z", "expires": "2027-10-22T18:05:59Z", "updated": "2026-10-22T18:11:29Z", "first_seen": "2026-10-22T18:14:06Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "norm.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.143.31" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "alexia.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.54.230" }, { "ttl": 21600, "type": "NS", "value": "alexia.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3036::6815:36e6" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3030::ac43:8f1f" } ], "dns_at": "2026-10-23T19:41:15Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.n1-us-google.com", "n1-us-google.com" ], "issuer": "Let's Encrypt / YE1", "serial": "5162de476ba1354329c651f2bdd8df94419", "sha256": "463aad030e6ee65f630b48242aa5b6f114c88b573204f943738fef84065337af", "subject": "n1-us-google.com", "valid_to": "2027-01-21T15:53:23Z", "valid_from": "2026-10-23T15:53:24Z" }, "whois": { "registrar": "UnstoppableUS4 LLC", "registrar_iana_id": "4576", "registrar_url": "http://Unstoppabledomains.com", "created": "2026-10-22T18:05:59Z", "updated": "2026-10-22T18:05:59Z", "expires": "2027-10-22T18:05:59Z", "status": [ "addPeriod", "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "lina.ns.cloudflare.com", "maxim.ns.cloudflare.com", "ns1.unstoppabledomains.com", "ns2.unstoppabledomains.com" ], "dnssec": "signedDelegation" }, "rdap": { "status": [ "client transfer prohibited", "client delete prohibited", "add period" ], "events": { "last changed": "2026-10-22T18:05:59Z", "registration": "2026-10-22T18:05:59Z", "registrar expiration": "2027-10-22T18:05:59Z", "last update of RDAP database": "2026-10-22T18:06:00Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T20:42:23Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "n1-us-google.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "trackers": { "requests": 11, "trackers": [ { "name": "ipify", "company": "ipify", "category": "Misc", "requests": 1 } ] }, "dns_server": { "ns": [ { "ip": "172.64.33.134", "host": "norm.ns.cloudflare.com" }, { "ip": "162.159.38.175", "host": "alexia.ns.cloudflare.com" } ], "zone": "n1-us-google.com" }, "dns": { "A": [ "172.67.143.31", "104.21.54.230" ], "NS": [ "alexia.ns.cloudflare.com", "norm.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"alexia.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418260788, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3030::ac43:8f1f", "2606:4700:3036::6815:36e6" ] } } } ```