mass.report
Scan Intelligence Report0/100
low Risk
www.google.com
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://profilerr.net/uk/najkrashi-chiti-dlya-cs2/&ved=2ahUKEwimpuvrnpWVAxUhUlUIHbpwKEYQFnoECA8QAQ&sqi=2&usg=AOvVaw13ek5NiGTC3ZJiCiytNbEU
IP
142.251.156.119 · Google LLC
Location
Mountain View, United States
Domain Age
10505 days
HTTP
200 · 87.0s
SSL
Valid· WR2, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: google.com
Scanned 5 times since Feb 14, 2026, 10:58 AM UTC
✗ Critical (85)
Registered-domain escalation
Submit google.com as the primary IOC, enriched with evidence from hostile subdomains like www.google.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Profilerr (profilerr.net)
Unknowngaming | technology · 7/19/2026
Summary
The final URL resolves to profilerr.net with Ukrainian language content offering CS2 cheats. The page title and content clearly impersonate a cheat site for CS2, but the domain is profilerr.net, not a major official brand. There are multiple external tracking/analytics requests and references to cheats, with a potential for credential harvesting, though the static HTML shows no login form or password field. The page displays branding that mimics legitimate gaming/cheat portal aesthetics, and the screenshot indicates CS2 cheat content. Overall, evidence supports a phishing/impostor potentially built to harvest user interactions or deliver malicious scripts, but there is no explicit credential capture form observed in the static HTML. More data would be needed to confirm credential phishing; the presence of suspicious endpoints and SPA behavior suggest abuse potential.
Evidence Summary
▸Observed 1 capture stage(s); canonical stage is settled_render.
▸POST targets observed during capture: https://www.google-analytics.com/g/collect?v=2&tid=G-SMWWM8B34C>m=45je66h0v880506414z89119086576za20gzb9119086576zd9119086576&_p=1781938771719&gcd=13l3l3l3l1l1&npa=0&dma=0&are=1&cid=149491497.1781938773&frm=0&lps=1&pscdl=noapi&rcb=10&sr=1280x720&uaa=x86&uab=64&uafvl=Not%253AA-Brand%3B99.0.0.0%7CHeadlessChrome%3B145.0.7632.6%7CChromium%3B145.0.7632.6&uam=&uamb=0&uap=Windows&uapv=10.0&uaw=0&ul=en-us&_s=1&tag_exp=115616985~115938466~115938468~119027224~119392696~119392704~119456239~119456247&sid=1781938772&sct=1&seg=0&dl=https%3A%2F%2Fprofilerr.net%2Fuk%2Fnajkrashi-chiti-dlya-cs2%2F&dr=https%3A%2F%2Fwww.google.com%2F&dt=%D0%A2%D0%9E%D0%9F%20%D1%87%D0%B8%D1%82%D1%96%D0%B2%20%D0%B4%D0%BB%D1%8F%20CS2%20%F0%9F%94%A5%20%D0%BD%D0%B0%D0%B9%D0%B6%D0%BE%D1%80%D1%81%D1%82%D0%BA%D1%96%D1%88%D1%96%20%D1%87%D0%B8%D1%82%D0%B8%20%D0%B4%D0%BB%D1%8F%20%D0%9A%D0%A1%20%7C%20Profilerr&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1460, https://profilerr.net/cdn-cgi/rum?.
▸Distinctive asset clues: gtm.js, post-RPqdAWh6.js, tailwindBase-7sHiLVvX.css, post-5J1kZWZO.css, profilerr-6oSR-fg3.svg, account-ACai9n4K.svg.
Capture
Stages: 1
Canonical: Settled Render
Changed: No
Credential Signals
Forms: 2
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 91
Hosts: 5
Domains: 5
Suspicious Endpoints
hxxps://profilerr[.]net/uk/api/state
hxxps://profilerr[.]net/uk/api/comments/post/9cc01468-8916-4d73-be80-68b5c36d1084?
hxxps://profilerr[.]net/uk/najkrashi-chiti-dlya-cs2/
Attack Techniques (2)
Brand impersonation (CS2 cheats site styled for Profilerr) visually mimicking gaming brandUse of analytics and third-party tracking (Google Analytics, GTM) to exfiltrate user interactions
Indicators of Compromise (2)
▸Two GET forms detected in HTML without visible credential fields
▸Suspicious endpoints listed in evidence: /uk/api/state, /uk/api/comments/post/... potentially collecting data
Risk AssessmentUsed in abuse reports
The page appears to be Profilerr's content page for CS2 cheats, which is plausible as an abuse site for distributing cheat content. The branding aligns with Profilerr rather than an official CS2 brand, indicating impersonation potential. The presence of analytics POSTs and multiple external scripts suggests data collection of user interactions, which could be used for misuse. The page lacks an obvious credential harvesting form in the static HTML, but SPA behavior means forms could be rendered later via JavaScript. Given the impersonation signals and suspicious endpoints, this warrants monitoring and potential takedown actions if confirming credential harvesting or distribution of illicit cheats; for abuse reports, classify as high-risk impersonation with potential data exfiltration.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API