Scan report · about 2 months agoPublic

easygrillkit.com

38.110.228.189AS174 · US

Submittedhttps://easygrillkit.com

Landed onhttps://easygrillkit.com/

Engine tags

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

What happened

Step by step, from what the scanner recorded.

Load 7.7 s · 68 requests

01 · Visitor openseasygrillkit.com

02 · Page shown

Promote Your Business with Merchant Center - Google for Retailstyled as Google · medium

03 · OutcomeSession hijack through a proxyThe brand's real pages are relayed through the attacker, who keeps the session.

Dangerous — confirmed threat

Automated

Its page title claims to be Google, which this address is not associated with. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

SupportingAiTM: brand assets served through a proxy

Google

Images/scripts belonging to a real brand were loaded THROUGH the attacker's host — the hallmark of an adversary-in-the-middle (Evilginx-style) proxy that relays the real login to steal the session.

Analyst noteStrong AiTM indicator when paired with a password form or a form-action mismatch. The brand whose assets are proxied is the impersonation target.

InfoBrand impersonation detected

Google · medium

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

InfoCross-domain scripts injected at runtime

4 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP: 38.110.228.189COGENT-174 - Cogent Communications, LLC, US · AS174US
TLS: CN=YR2, O=Let's Encrypt, C=US · expires Nov 4, 2026
Redirects: 0 hops · / → /

WHOIS

Registrar: HOSTINGER operations, UAB
Created: Aug 6, 2026
Expires: Aug 6, 2027
Nameservers: horizon.dns-parking.comorbit.dns-parking.com

15 malicious7 suspicious

Hashes & fingerprints

Page Hash214484b04aee037a47edbf5a03b198c214664ac69ea3591f3f926c5816e86dd2 Favicon Hash15b8e53b2da521cb17e5957b427b2d9dd8bf5421f06fc6d880d5eee2468b047b DOM Hash0bc23fbf4e85453c7b16e26b01dd33440a3ca2c128b1b995741500f860d70d9f Screenshot pHashed1f1e81f0f0f8c0 JARM15d3fd16d29d29d00042d43d000000fe02290512647416dcf0a400ccbc0b6b JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert Thumbprint940D5DEA2626342CF8672ABFA9B4381DA24727DB Cert IssuerCN=YR2, O=Let's Encrypt, C=US

Page capture

Live

Title “Promote Your Business with Merchant Center - Google for Retail” · brand shown: Google (medium)

Visit Site

Engines

7 · time to verdict