mass.report
Scan Intelligence Report0/100
low Risk
www.google.com
https://www.google.com/url?q=https://auth-permit-contract-web3-wallet-connect.emerentias-erben.com&source=gmail&ust=1782911503951000&usg=AOvVaw1kQVihwhxvxkU5tWMuqWYV&gad_source=1&gad_campaignid=23920228285&gbraid=0AAAAADFCH6PGlAPUfZskdMNe6LTwzx16G&gclid=EAIaIQobChMI-_m9jJyvlQMVTyzUAR1wzh1vEAAYASAAEgJ36vD_BwE
IP
142.251.154.119 · Google LLC
Location
Mountain View, United States
Domain Age
10515 days
HTTP
200 · 41.7s
SSL
Valid· WR2, Google Trust Services, US
Status
COMPLETED
Redirect Chain (2 hops)
302https://www.google.com/url?q=https://auth-permit-contract-web3-wallet-connect.emerentias-erben.com&source=gmail&ust=1782911503951000&usg=AOvVaw1kQVihwhxvxkU5tWMuqWYV&gad_source=1&gad_campaignid=23920228285&gbraid=0AAAAADFCH6PGlAPUfZskdMNe6LTwzx16G&gclid=EAIaIQobChMI-_m9jJyvlQMVTyzUAR1wzh1vEAAYASAAEgJ36vD_BwE
302https://auth-permit-contract-web3-wallet-connect.emerentias-erben.com/
Domain Intelligence: google.com
Scanned 5 times since Feb 14, 2026, 10:58 AM UTC
✗ Critical (85)
Registered-domain escalation
Submit google.com as the primary IOC, enriched with evidence from hostile subdomains like www.google.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
technology | finance | ecommerce | other · 7/19/2026
Summary
The page visually imitates Google’s homepage, including the Google logo and search UI, but the final URL and redirect chain point to an off-brand domain lineage (auth-permit-contract-web3-wallet-connect.emerentias-erben.com) that is not Google's official domain. The page content in the screenshot matches Google branding, yet the navigating URL and redirect chain suggest potential impersonation/cloaking. There is evidence of unusual external resource loading and a redirect path that could be used for credential harvesting, but no direct credential form submitted to a Google domain is observed in the static HTML capture. Given the mismatch between branding and domain origin, impersonation is suspected, though conclusive credential capture behavior is not definitively demonstrated in the captured data.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=3NhDapHwBvnW5NoP-YbTwA8&rt=wsrt.548,hst.47,prt.235,aft.235&ddl=1&folr=_3NhDapHwBvnW5NoP-YbTwA8_9&imn=12&dtc=190&stc=55&ima=0&imad=0&imac=1&wh=720&nt=navigate&dt=&ts=69193&nhp=h2&ant=push&opi=89978449, https://www.google.com/gen_204?s=async&astyp=hpba&t=all&atyp=csi&ei=3NhDauLsGb6j5NoPnIPcqQ4&rt=ipf.35,ipfr.216,ttfb.216,st.216,ipfrl.217,acrt.217,aaft.217,art.220,ns.-660&twt=1&mwt=1&imn=0&ima=0&sv=&cb=112&ucb=102&folid=_3NhDapHwBvnW5NoP-YbTwA8_9, https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData.
▸Distinctive asset clues: rs=AA2YrTs7cU8uR_Gvt5MxLbVMCfcZk2xF7w, m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi, m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi, rs=AA2YrTvVbU6kFYShmb37FXVbeSuk0QBnfQ, world-cup-2026-the-art-of-the-penalty-kick-72-6753651837111290.2-lsg.png, world-cup-2026-the-art-of-the-penalty-kick-72-6753651837111290.2-law.gif.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 55
Hosts: 7
Domains: 3
Suspicious Endpoints
hxxps://www[.]google[.]com/search
Attack Techniques (1)
Brand impersonation via cloning of a well-known UI (Google) on a non-official domain
Indicators of Compromise (1)
▸Scanner indicates potential impersonation signal due to domain-brand mismatch
Risk AssessmentUsed in abuse reports
The screenshot shows Google branding on a page hosted at a non-Google domain, with redirects through Google URLs to an off-brand domain. This strongly suggests an impersonation attempt or phishing setup designed to harvest credentials or mislead victims. The presence of hidden form inputs and extensive external script loading increases risk, as these patterns are often used in credential-phishing or data-exfiltration setups. Recommend heightened scrutiny and takedown actions as appropriate for impersonation, and consider additional blocking of the off-brand host if abuse is confirmed.
Recommended Action
Block URL
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API