Scan report · about 2 months agoPublic

gm2.drr.ac

172.64.150.130AS13335 · US

Submittedhttps://gm2.drr.ac/

Suspicious: page navigated to a document it built in memory (blob:) claiming Google, on non-legit host gm2.drr.ac; the payload never crossed the network

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

StrongPayload built in the browser, never downloaded

page navigated to a document it built in memory (blob:) claiming Google, on non-legit host gm2.drr.ac; the payload never crossed the network

The page assembled its next screen in memory and navigated to it as a blob: document. Nothing was fetched, so the page you would see never crossed the network — and it claims a brand this host does not own.

Analyst noteThere is no second URL to submit anywhere: a blob URL lives only in the tab that made it. Pivot on THIS host, on the script that builds the document, and on any external script it pulls into the blob — that host is usually the kit, and it is configuration, so expect it to rotate.

InfoBrand impersonation detected

Google · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 172.64.150.130CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Oct 11, 2026

61 malicious14 suspicious

Hashes & fingerprints

Page Hash98750736c195436063df49f883d841c5fcc08dd51dc28235f7fe2cd82b70aad0 Favicon Hash6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770 Screenshot pHashc3993c6633e69364 JARM27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintEC2BD231F6D2A1FFAA9BC24019D743DD04C069D0 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Sign in - Google Accounts” · brand shown: Google (low)

Visit Site

Engines

7 · time to verdict