https://edgarsanson.com/
51.222.153.238 · OVH Hosting, Inc.
Montreal, Canada
6656 days
200 · 42.0s
Valid· R13, Let's Encrypt, US
COMPLETED
No KB/IOK detections were recorded for this scan.
real_estate | technology | ecommerce | finance | other · 6/3/2026
The page appears hosted at edgarsanson.com with branding for a real estate broker (Edgar Sanson) Montreal. The visual screenshot and page title suggest impersonation of a real estate brand, but there is no clear evidence of credential harvesting or impersonation of a widely recognized consumer brand. The HTML/DOM indicates a single form (likely a contact form) but login/password fields are absent; numerous analytics scripts and iframes are present. The combination of heavy third-party analytics, an embedded Google map iframe, and a real estate branding on a non-official domain warrants scrutiny for potential misuse, though explicit phishing targeting a known brand is not conclusively demonstrated from the available data.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 149
Hosts: 18
Domains: 13
Suspicious Endpoints
hxxps://edgarsanson[.]com/#wpcf7-f894-p123-o1
No suspicious indicators identified
This scan indicates potential first-party vanity or impersonation risk due to real-estate branding on a domain that does not clearly correspond to an official brand site in widely recognized registries. The page loads extensive third-party analytics and a Google Maps iframe, which is common for legitimate business sites but can be abused for credential phishing if a clone uses near-identical branding. The evidence does not show a credential harvesting form or explicit impersonation of a widely recognized consumer brand; however, the combination of domain-brand mismatch suspicion, visible branding on a non-official domain, and aggressive tracking suggests monitoring and possible domain-level abuse. The site is accessible, has a valid but short-life SSL certificate, and employs WAF-evasion-like loading of multiple third-party resources, which warrants cautious monitoring.
Monitor