# PhishDestroy domain threat record: ww19.googlesheets.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/ww19.googlesheets.com/ Machine-readable companion: https://phishdestroy.io/domain/ww19.googlesheets.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-25 13:49:22 UTC - Last availability or vendor check: 2026-10-25 23:00:44 UTC - Stored record updated: 2026-10-26 04:30:29 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 208.91.196.145 - Registrar in stored WHOIS data: Internet Domain Service BS Corp - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2016-05-24 17:16:36 UTC ## Evidence links - URLScan report: https://urlscan.io/result/019ff06b-cc32-7346-88bf-b25e61b45aaf/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/ww19.googlesheets.com - Certificate Transparency search: https://crt.sh/?q=%25.ww19.googlesheets.com - Web Archive lookup: https://web.archive.org/web/*/https://ww19.googlesheets.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has added ww19.googlesheets.com to its internal blocklist. The page returned an HTTP 200 response but displayed only an error message, preventing any content analysis. The domain was first seen by PhishDestroy on 2026-10-25. How the scam works A domain that resembles a legitimate service can be used to lure users into credential entry or malware download, but no such behavior was observed on this site. The current listing reflects uncertainty rather than a confirmed phishing or fraud operation. Evidence VirusTotal scanned the domain on 2026-10-23 and reported 0 detections out of 92 engines. Google Safe Browsing checked on 2026-10-25 and did not flag the URL. urlscan.io captured the site on 2026-08-11; its machine‑learning engine gave a malicious score of 18, yet the overall verdict was non‑malicious. OTX listed zero pulses on 2026-10-25, external blocklists reported no hits, and PhishDestroy’s internal list marks the domain as suspicious. Infrastructure The recorded IP was 208.91.196.145, listed as belonging to Confluence Networks Inc in the British Virgin Islands (ASN 40034). The subdomain was 25 days old at the time of observation, CNAME‑pointed to 9145.searchmagnified.com and used TLS 1.3 with a certificate valid until 2026-11-09. DNS records at that time showed standard A, CNAME, MX, NS and TXT entries without DNSSEC signatures. What to do Do not enter credentials, seed phrases, or download files from this domain; if you have already submitted credentials, change them immediately. Monitor accounts for unexpected activity and report any suspicious messages to the relevant service provider. Defenders should block traffic to ww19.googlesheets.com and review logs for any connections to the recorded IP address. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/019ff06b-cc32-7346-88bf-b25e61b45aaf/ Cloudflare Radar report: https://radar.cloudflare.com/scan/621a34d8-b45f-438d-86d6-d206c96f2c7c Stored capture screenshot: https://urlscan.io/screenshots/019ff06b-cc32-7346-88bf-b25e61b45aaf.png Cloudflare Radar screenshot (2026-10-25T13:54:17Z): https://screenshots.phishdestroy.io/cf/621a34d8-b45f-438d-86d6-d206c96f2c7c.png VirusTotal report: https://www.virustotal.com/gui/domain/ww19.googlesheets.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=ww19.googlesheets.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-25 13:58:24 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/019ff06b-cc32-7346-88bf-b25e61b45aaf.png Captured: 2026-10-25 13:49:22 UTC - URLScan capture: https://screenshots.phishdestroy.io/019ff06b-cc32-7346-88bf-b25e61b45aaf.png Captured: 2026-10-26 04:30:29 UTC Source report: https://urlscan.io/result/019ff06b-cc32-7346-88bf-b25e61b45aaf/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/621a34d8-b45f-438d-86d6-d206c96f2c7c.png Captured: 2026-10-25 13:54:17 UTC Source report: https://radar.cloudflare.com/scan/621a34d8-b45f-438d-86d6-d206c96f2c7c SHA-256: a5db7ab655d3900bfb2bf44f8483ca7ce06fc6f795376f14b777be50f1f0af62 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-25T13:57:18Z", "uuid": "019ff06b-cc32-7346-88bf-b25e61b45aaf", "scanned_at": "2026-08-11T10:43:54Z", "final_url": "http://ww19.googlesheets.com/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://googlesheets.com/", "from": "https://googlesheets.com/" }, { "to": "http://ww19.googlesheets.com/", "from": "https://googlesheets.com/", "status": 302 }, { "to": "https://ww19.googlesheets.com/", "from": "http://ww19.googlesheets.com/", "status": 307 }, { "to": "http://ww19.googlesheets.com/", "from": "https://ww19.googlesheets.com/", "status": 307 } ], "ip": "208.91.196.145", "domains": [ "googlesheets.com" ], "ips": [ "208.91.196.145", "5.79.75.200" ], "asns": [ "40034", "60781" ], "countries": [ "VG", "NL" ], "doc_hash": "536f942fd9061f19440fa2c2e125d36cd60bccd3240402ba93dba128536d95c0", "cookies": [ "sid" ], "tls": { "san": [ "*.googlesheets.com", "googlesheets.com" ], "cipher": "AES_128_GCM", "issuer": "YR2", "subject": "googlesheets.com", "protocol": "TLS 1.3", "valid_to": "2026-11-09T09:09:48Z", "valid_from": "2026-08-11T09:09:49Z" }, "domain_age_days": 25, "apex_age_days": 2517, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 18, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Cowboy", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-25T13:57:20Z", "uuid": "621a34d8-b45f-438d-86d6-d206c96f2c7c", "scanned_at": "2026-10-25T13:54:17Z", "final_url": "https://ww19.googlesheets.com/", "history": [ { "url": "https://ww19.googlesheets.com/", "status": 0 } ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "ww19.googlesheets.com", "type": "CNAME", "value": "9145.searchmagnified.com" }, { "name": "ww19.googlesheets.com", "type": "CNAME", "value": "9145.searchmagnified.com" } ], "dnssec_valid": false, "whois": { "registrar": "Internet Domain Service BS Corp", "created": "2016-05-24T19:16:36Z", "updated": "2026-05-21T05:20:56Z", "expires": "2027-05-24T19:16:36Z", "nameservers": [ "ns1.brainydns.com", "ns2.brainydns.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-25T13:53:28Z", "analysis_at": "2026-10-23T07:55:24Z", "stats": { "timeout": 0, "harmless": 0, "malicious": 0, "suspicious": 0, "undetected": 92 }, "reputation": 0, "registrar": "Internet Domain Service BS Corp", "created": "2016-05-24T19:16:36Z", "expires": "2027-05-24T19:16:36Z", "updated": "2026-05-21T05:20:56Z", "first_seen": "2026-10-23T07:55:57Z", "dns": [ { "ttl": 300, "type": "MX", "value": "~", "priority": 300 }, { "ttl": 300, "type": "TXT", "value": "v=spf1 a -all" }, { "ttl": 446, "type": "NS", "value": "ns2.cnomy.com" }, { "ttl": 300, "type": "SOA", "rname": "abuse.confluence-networks.com", "value": "ns1.cnomy.com" }, { "ttl": 300, "type": "CNAME", "value": "9145.searchmagnified.com" }, { "ttl": 299, "type": "CNAME", "value": "9145.searchmagnified.com" }, { "ttl": 517, "type": "A", "value": "208.91.196.145" }, { "ttl": 446, "type": "NS", "value": "ns1.cnomy.com" } ], "dns_at": "2026-10-23T07:55:57Z", "whois": { "registrar": "Internet Domain Service BS Corp", "registrar_iana_id": "2487", "registrar_url": "http://www.internet.bs", "created": "2016-05-24T19:16:36Z", "updated": "2026-05-21T05:20:56Z", "expires": "2027-05-24T19:16:36Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1.brainydns.com", "ns2.brainydns.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-25T13:57:51Z", "mail_config": { "mx": [ "~" ], "spf": "v=spf1 a -all", "spf_lookups": 1 }, "caa_records": { "domain": "ww19.googlesheets.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "ports": { "open": [ 80, 443 ] }, "dns_server": { "ns": [ { "ip": "5.79.71.13", "host": "ns2.koaladns.com" }, { "ip": "23.19.67.18", "host": "ns1.koaladns.com" } ], "zone": "googlesheets.com" }, "location": { "ip": "208.91.196.145", "asn": "40034", "org": "Confluence Networks Inc", "city": "Road Town", "country": "VG" }, "dns": { "A": [ "208.91.196.145" ], "MX": [ "{\"exchange\": \"~\", \"priority\": 300}" ], "NS": [ "ns1.cnomy.com", "ns2.cnomy.com" ], "PTR": [ "ns1.cnomy.com" ], "SOA": "{\"nsname\": \"ns1.cnomy.com\", \"hostmaster\": \"abuse.confluence-networks.com\", \"serial\": 2011062801, \"refresh\": 3600, \"retry\": 900, \"expire\": 604800, \"minttl\": 86400}", "TXT": [ "v=spf1 a -all" ], "CNAME": [ "9145.searchmagnified.com" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": true }, "get_ip": { "ip": "208.91.196.145", "family": 4 }, "whois": { "registrar": "Internet Domain Service BS Corp", "created": "2016-05-24T19:16:36Z", "updated": "2026-05-21T05:20:56Z", "expires": "2027-05-24T19:16:36Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "ns1.brainydns.com", "ns2.brainydns.com" ] } } } ```