mass.report
Scan Intelligence Report0/100
critical Risk
www.google.com
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://nz.ua/&ved=2ahUKEwi5qMy5npWVAxVcKxAIHSdrHfUQFnoECA8QAQ&sqi=2&usg=AOvVaw15PQiT4an2WLUVovmPl_Sd
IP
142.251.156.119 · Google LLC
Location
Mountain View, United States
Domain Age
10505 days
HTTP
200 · 85.9s
SSL
Valid· WR2, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: google.com
Scanned 5 times since Feb 14, 2026, 10:58 AM UTC
✗ Critical (85)
Registered-domain escalation
Submit google.com as the primary IOC, enriched with evidence from hostile subdomains like www.google.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
nz.ua
Credential Phishingeducation | technology · 7/19/2026
Summary
The page presents branding for nz.ua with Ukrainian text and login UI. However, the final URL is nz.ua, not a well-known external brand, and the screenshot shows a login button and credential fields suggesting a sign-in flow. The evidence indicates a legitimate-looking login surface on nz.ua itself rather than impersonation of a separate first-party brand. Despite that, the presence of a login form, password field, and multiple external analytics/ads scripts on a page that appears to be a landing site could be used for credential collection if redirected or misused. The domain appears legitimate and aligns with the nz.ua brand in the page content; there is no clear impersonation of another brand in the captured signals. Given the page content, this is best categorized as potential credential collection activity on nz.ua, but not impersonation of a different brand.
Evidence Summary
▸Observed 1 capture stage(s); canonical stage is settled_render.
▸Canonical stage contains password collection UI.
▸POST targets observed during capture: https://nz.ua/cdn-cgi/challenge-platform/h/g/jsd/oneshot/f95a7f38c08f/0.7500591209308888:1781935317:Hjb2rnmHl-YLzC8doFocBcK1G4dhTJm1nqXLQ-i5dqc/a0e8e1a5ad28a629, https://www.google-analytics.com/g/collect?v=2&tid=G-10GE88F7WH>m=45je66h0h1v881262799za20g&_p=1781938668703&gcd=13l3l3l3l1l1&npa=0&dma=0&_eu=AAAI&are=1&cid=1409627371.1781938670&frm=0&lps=1&pscdl=noapi&rcb=11&sr=1280x720&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Windows&uapv=10.0&uaw=0&ul=en-us&_s=1&tag_exp=115616986~115938466~115938468~119027224~119392696~119392704~119456239~119456247&sid=1781938670&sct=1&seg=0&dl=https%3A%2F%2Fnz.ua%2F&dr=https%3A%2F%2Fwww.google.com%2F&dt=%7C%20%D0%9D%D0%BE%D0%B2%D1%96%20%D0%B7%D0%BD%D0%B0%D0%BD%D0%BD%D1%8F&en=page_view&_fv=1&_ss=1&tfd=1868, https://www.google-analytics.com/g/collect?v=2&tid=G-K57V1MWP8L>m=45je66h0h2v9255344415za200&_p=1781938668703&gcd=13l3l3l3l1l1&npa=0&dma=0&are=1&cid=1409627371.1781938670&frm=0&lps=1&pscdl=noapi&rcb=15&sr=1280x720&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Windows&uapv=10.0&uaw=0&ul=en-us&_s=1&tag_exp=115938466~115938468~119027224~119392696~119392704~119456239~119456247&sid=1781938670&sct=1&seg=0&dl=https%3A%2F%2Fnz.ua%2F&dr=https%3A%2F%2Fwww.google.com%2F&dt=%7C%20%D0%9D%D0%BE%D0%B2%D1%96%20%D0%B7%D0%BD%D0%B0%D0%BD%D0%BD%D1%8F&en=page_view&_fv=1&_ss=1&_ee=1&tfd=2033.
▸Distinctive asset clues: adsbygoogle.js, js, support.css, modal-colors.css, logo-bw.svg, lp-features.png.
Capture
Stages: 1
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 2
Password fields: 1
Late-stage login UI: No
Resource Signals
Resources: 77
Hosts: 9
Domains: 8
Suspicious Endpoints
hxxps://nz[.]ua/login
hxxps://nz[.]ua/account/forgot-password
Attack Techniques (4)
Presence of login form and password fieldPOST endpoints to /login and /account/forgot-passwordExternal analytics and ad scripts loaded (Google Analytics, Ads, GTM)Iframes and multiple external script loads
Indicators of Compromise (8)
▸Form POST to https://nz.ua/login
▸Form POST to https://nz.ua/account/forgot-password
▸Password input field detected
▸Page title includes Ukrainian branding 'Нові знання' and nz.ua imagery
▸External scripts from Google Analytics/Tag Manager and ads networks
▸IFrame reference to googleads doubleclick
▸SSL certificate valid for www.google.com (unrelated) but page itself served over HTTPS with nz.ua assets
▸Final URL shown as https://nz.ua/ (off-domain navigation not detected)
Risk AssessmentUsed in abuse reports
The scan shows a legitimate-looking login surface on the nz.ua domain, with password fields and POST endpoints for login and forgot-password, along with external analytics/ads integrations. There is no clear indication of impersonation of a separate brand in the visible UI; the branding matches nz.ua. However, credential-collection workflows on landing pages can be abused if misused or paired with spoofed redirects. The presence of a login widget and password field warrants cautious monitoring for potential credential harvesting attempts, especially if additional domain similarity signals emerge or if the site redirects to a deceptive login surface on a different domain. Recommend ongoing monitoring and verification of the site's authentication endpoints and scripts for abuse potential.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API