Scan report · about 2 months agoPublic

gm2.drr.ac

104.18.37.126AS13335 · US

Submittedhttps://gm2.drr.ac/

Suspicious: page navigated to a document it built in memory (blob:) claiming Google, on non-legit host gm2.drr.ac; the payload never crossed the network

Verdict

2 of 7 enginesMaliciousAutomated

Own this site?

Dangerous — confirmed threat

Automated

It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.

What to do

Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.

This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.

Findings

Strongest first

StrongPayload built in the browser, never downloaded

page navigated to a document it built in memory (blob:) claiming Google, on non-legit host gm2.drr.ac; the payload never crossed the network

The page assembled its next screen in memory and navigated to it as a blob: document. Nothing was fetched, so the page you would see never crossed the network — and it claims a brand this host does not own.

Analyst noteThere is no second URL to submit anywhere: a blob URL lives only in the tab that made it. Pivot on THIS host, on the script that builds the document, and on any external script it pulls into the blob — that host is usually the kit, and it is configuration, so expect it to rotate.

InfoBrand impersonation detected

Google · low

The page presents itself as a known brand (brand keywords/branding detected).

Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.

Infrastructure

IP: 104.18.37.126CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
TLS: CN=WE1, O=Google Trust Services, C=US · expires Oct 11, 2026

53 malicious23 suspicious

Hashes & fingerprints

Page Hash189d68941b55b3ca952710aa9c5b6aad699efbdd8a57d90f97773f38320ba025 Favicon Hash6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770 Screenshot pHashf1d1d0d02e280ed0 JARM27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6 JA4Xa373a9f83c6b_7022c563de38_2e3757343cb0 Cert ThumbprintEC2BD231F6D2A1FFAA9BC24019D743DD04C069D0 Cert IssuerCN=WE1, O=Google Trust Services, C=US

Page capture

Live

Title “Sign in - Google Accounts” · brand shown: Google (low)

Visit Site

Engines

7 · time to verdict