mass.report
Scan Intelligence Report0/100
medium Risk
auth-permit-contract-web3-wallet-connect.emerentias-erben.com
https://auth-permit-contract-web3-wallet-connect.emerentias-erben.com/
IP
104.21.57.78 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
589 days
HTTP
200 · 20.2s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Registered-domain escalation
Submit emerentias-erben.com as the primary IOC, enriched with evidence from hostile subdomains like auth-permit-contract-web3-wallet-connect.emerentias-erben.com.
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
technology · 7/19/2026
Summary
The page presents Google branding (title GOOGLE, Google logo in page visuals) on a non-official domain (auth-permit-contract-web3-wallet-connect.emerentias-erben.com) and redirects to www.google.com. DNS/WHOIS shows a domain age of ~589 days, but the SSL certificate is issued to emerentias-erben.com, not Google. The final URL resolves to google.com, yet the host and visible branding on the page indicate impersonation of Google. The page also contains hidden form inputs and a high number of external scripts, with multiple Google-origin endpoints observed in network traces, which is characteristic of credential-harvesting impersonation attempts delivered via a spoofed login surface or data capture UI loaded through a compromised or malicious host.
Evidence Summary
▸Observed 3 capture stage(s); canonical stage is late_render_3s.
▸POST targets observed during capture: https://www.google.com/gen_204?s=webhp&t=aft&atyp=csi&ei=7sxDasnbFeGe5NoP7rXfeA&rt=wsrt.545,hst.40,prt.219,aft.219&ddl=1&folr=_7sxDasnbFeGe5NoP7rXfeA_10&imn=11&dtc=193&stc=55&ima=0&imad=0&imac=1&wh=720&nt=navigate&dt=&ts=69498&nhp=h2&ant=push&opi=89978449, https://www.google.com/gen_204?s=async&astyp=hpba&t=all&atyp=csi&ei=7sxDao2aJ4mf5NoPp_id0Aw&rt=ipf.12,ipfr.149,ttfb.149,st.149,ipfrl.150,acrt.150,aaft.150,art.150,ns.-749&twt=1&mwt=1&imn=0&ima=0&sv=&cb=112&ucb=102&folid=_7sxDasnbFeGe5NoP7rXfeA_10, https://ogads-pa.clients6.google.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyncData.
▸Distinctive asset clues: rs=AA2YrTs7cU8uR_Gvt5MxLbVMCfcZk2xF7w, m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi, m=cdos,hsm,jsa,mb4ZUb,cEt90b,SNUn3,qddgKe,sTsDMc,dtl0hd,eHDfl,YV5bee,d,csi, rs=AA2YrTvVbU6kFYShmb37FXVbeSuk0QBnfQ, world-cup-2026-the-art-of-the-penalty-kick-72-6753651837111290.2-lsg.png, world-cup-2026-the-art-of-the-penalty-kick-72-6753651837111290.2-law.gif.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 0
Late-stage login UI: No
Resource Signals
Resources: 48
Hosts: 7
Domains: 3
Suspicious Endpoints
hxxps://www[.]google[.]com/search
Attack Techniques (2)
Brand impersonation / typosquatting indicators (Google branding on a non-official domain)Hidden form inputs suggesting credential capture or automated form handling
Indicators of Compromise (2)
▸Login form presence: static HTML shows a single GET form to google search with hidden inputs; potential credential-capture surface
▸Risk indicators note impersonation signals and high external script count
Risk AssessmentUsed in abuse reports
The evidence strongly suggests impersonation of Google on a non-official domain, with a final redirect to Google. The page title and branding mimic Google, which is a classic phishing tactic to harvest credentials or redirects, even though the final destination is legitimate. The presence of hidden inputs and numerous external scripts increases the risk of credential capture or data exfiltration. Given these signals, this is actionable abuse: phishing/impersonation attempting to harvest user data through a counterfeit Google surface hosted on a separate domain.
Recommended Action
Monitor
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API