# PhishDestroy domain threat record: scgamesteal.blogspot.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/scgamesteal.blogspot.com/
Machine-readable companion: https://phishdestroy.io/domain/scgamesteal.blogspot.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-14 04:20:24 UTC
- Last availability or vendor check: 2026-10-22 10:06:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 3/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: google

## Stored infrastructure

- Observed IP address: 142.250.154.132
- Registrar in stored WHOIS data: Google Blogger
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200
- Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a09e27-1ba3-77e7-bd1a-925536e7d7fb/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/scgamesteal.blogspot.com
- Certificate Transparency search: https://crt.sh/?q=%25.scgamesteal.blogspot.com
- Web Archive lookup: https://web.archive.org/web/*/https://scgamesteal.blogspot.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
scgamesteal.blogspot.com is a free Blogger site titled "Steal an Egg · All Drops". It is built to look like an official or community resource for the game, and it targets players searching for item drops, codes and rewards. PhishDestroy first flagged it on 2026-09-14, and it was still online and serving its content when last checked on 2026-10-19.

How the scam works
Pages like this use a game's name and the promise of a full drop list to look legitimate to fans. The usual next step is a prompt to "claim" an item by signing in, linking a game or platform account, or following a link to a look-alike login page. Anything typed there, such as usernames, passwords or verification codes, goes to the operator, who can then hijack the account and strip its inventory. The page title presents an item drops guide, and we classified the site as impersonation phishing.

Evidence
Independent detection is thin. On 2026-09-28, 3 of 91 VirusTotal engines flagged the site: Forcepoint ThreatSeeker, LevelBlue and VIPRE. PhishDestroy is currently the only blocklist listing it. With coverage this low, most browsers and security tools will not warn visitors, so the absence of an alert does not mean the page is safe.

Infrastructure
The site is a blogspot subdomain, created through Google Blogger rather than a domain someone registered. Setting up a page like this is free and instant, which makes it easy to replace if it is taken down. It runs on Google LLC's network in the US, and its Google Trust Services certificate is the one Blogger issues to every hosted site. The padlock in the address bar is automatic on this platform and says nothing about whether the page is trustworthy.

What to do
If you entered a game, platform or email login on this page, change that password right away and use a new one you have not used elsewhere. Then turn on two-factor authentication, sign out all active sessions, and check your inventory and linked accounts for changes. Do not run any files or "claim tools" the page offered, and ignore any follow-up messages promising your item. Defenders should block the subdomain and report it through Google Blogger's abuse channel, and community moderators can warn players about fake drop pages that ask for logins.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a09e27-1ba3-77e7-bd1a-925536e7d7fb/
VirusTotal report: https://www.virustotal.com/gui/domain/scgamesteal.blogspot.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=scgamesteal.blogspot.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:43:05 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a09e27-1ba3-77e7-bd1a-925536e7d7fb.png
  Captured: 2026-09-14 04:20:24 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a09e27-1ba3-77e7-bd1a-925536e7d7fb.png
  Captured: 2026-09-22 03:30:37 UTC
  Source report: https://urlscan.io/result/01a09e27-1ba3-77e7-bd1a-925536e7d7fb/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/13254641-ab0e-488f-82ed-c0583fa39888.png
  Captured: 2026-09-21 07:53:04 UTC
  Source report: https://radar.cloudflare.com/scan/13254641-ab0e-488f-82ed-c0583fa39888
  SHA-256: 97204f5c7ab3ad00676c1423aaca01c3392f704d92731ff2a00b969e2244103d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:22:49Z",
        "uuid": "01a09e27-1ba3-77e7-bd1a-925536e7d7fb",
        "scanned_at": "2026-09-14T04:22:45Z",
        "final_url": "https://scgamesteal.blogspot.com/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://scgamesteal.blogspot.com/",
                "from": "https://scgamesteal.blogspot.com/",
                "status": 302
            }
        ],
        "ip": "142.251.20.132",
        "ptr": "bx-in-f132.1e100.net",
        "domains": [
            "stealeggs.pages.dev",
            "cdnjs.cloudflare.com",
            "fonts.gstatic.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.13.94",
            "172.66.47.182",
            "142.250.154.95",
            "104.17.25.14",
            "142.251.20.132"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "lockerpreview.com",
            "www.blogger.com"
        ],
        "doc_hash": "25e54b3d5ab641d939948575fa3f056977232faecbb87ecaa796e1e068f9f980",
        "script_hashes": [
            "068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568"
        ],
        "globals": [
            "adsbygoogle",
            "openLocker",
            "closeModal",
            "showScreen",
            "startFakeGen",
            "cookieChoices",
            "LOCKER_URL"
        ],
        "tls": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE2",
            "subject": "misc-sni.blogspot.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-02T08:38:52Z",
            "valid_from": "2026-08-10T08:38:53Z"
        },
        "domain_age_days": 17,
        "apex_age_days": 17,
        "tls_age_days": 34,
        "tls_valid_days": 83,
        "requests": 17,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "GSE",
            "content-type": "text/html; charset=UTF-8",
            "x-content-type-options": "nosniff"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:30:57Z",
        "uuid": "13254641-ab0e-488f-82ed-c0583fa39888",
        "scanned_at": "2026-09-21T07:53:04Z",
        "final_url": "https://scgamesteal.blogspot.com/",
        "status": 200,
        "history": [
            {
                "url": "https://scgamesteal.blogspot.com/",
                "status": 200
            }
        ],
        "dom_hash": "405a1444e44158ea03236617e5c5d76726a7873924e118764ead2c6fc5cd71bb",
        "doc_hash": "9d85984659f56f9acf5e81765c5c6cb79f0ca6658ccc6713b1bd492a8ede78f3",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "scgamesteal.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            },
            {
                "name": "scgamesteal.blogspot.com",
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dnssec_valid": false,
        "ip": "142.251.218.65",
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2000-07-31T21:38:58Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T21:38:58Z",
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T01:54:02Z",
        "analysis_at": "2026-10-18T07:41:26Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 0,
            "undetected": 35
        },
        "detections": {
            "VIPRE": "malware",
            "LevelBlue": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "MarkMonitor Inc.",
        "created": "2000-07-31T21:38:58Z",
        "expires": "2027-07-31T21:38:58Z",
        "updated": "2026-06-29T10:34:06Z",
        "first_seen": "2026-09-14T04:21:29Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2607:f8b0:4001:c08::84"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "74.125.69.132"
            },
            {
                "ttl": 300,
                "type": "CNAME",
                "value": "blogspot.l.googleusercontent.com"
            }
        ],
        "dns_at": "2026-10-18T07:42:26Z",
        "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c",
        "cert": {
            "san": [
                "misc-sni.blogspot.com",
                "blogspot.ae",
                "*.blogspot.ae",
                "blogspot.al",
                "*.blogspot.al",
                "blogspot.am",
                "*.blogspot.am",
                "blogspot.ba",
                "*.blogspot.ba",
                "blogspot.be"
            ],
            "issuer": "Google Trust Services / WE2",
            "serial": "814ac5b024f8ff6f10caaecf9f796a9f",
            "sha256": "7e702db2cd863f12878210369da95cee319bdb748393501d05c91b69cf032638",
            "subject": "misc-sni.blogspot.com",
            "valid_to": "2026-12-21T18:40:33Z",
            "valid_from": "2026-09-28T18:40:34Z"
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "registrar_iana_id": "292",
            "registrar_url": "http://www.markmonitor.com",
            "created": "2000-07-31T07:00:00Z",
            "updated": "2026-06-29T10:34:06Z",
            "expires": "2027-07-31T00:00:00Z",
            "status": [
                "clientDeleteProhibited",
                "clientTransferProhibited",
                "clientUpdateProhibited",
                "serverDeleteProhibited",
                "serverTransferProhibited",
                "serverUpdateProhibited"
            ],
            "nameservers": [
                "ns1.google.com",
                "ns2.google.com",
                "ns3.google.com",
                "ns4.google.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```