metrobumenimains[.]wasmer[.]app

Analysis of metrobumenimains.wasmer.app shows a high‑risk brand‑impersonation campaign targeting Google. The site was hosted on the IP 5.78.28.109, which belongs to AS12876 Scaleway SAS in France. Registration was performed through Squarespace Domains II LLC, and the domain used the authoritative servers alpha.ns.wasmernet.com and beta.ns.wasmernet.com. The TLS certificate is issued by Let’s Encrypt (CN=YE2), indicating a valid HTTPS endpoint, but the HTTP response code is 410, confirming the content has been removed.

The page title returned by the server reads “Navy Federal Credit Union – Our Members are the Mission®”, which does not align with the claimed Google impersonation, suggesting the page content has been altered or taken down. VirusTotal scans returned 12 positive detections out of 91 scanners, and Google Safe Browsing classifies the URL as social‑engineering. The domain appears on a single public blocklist and is listed as blocked by PhishDestroy.

No additional intelligence such as malware payloads or credential‑harvesting forms is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor the hosting AS for related activity, and consider adding the domain to internal allow‑list exclusions for legitimate Google services. Because the site is currently offline (HTTP 410) and no active payloads have been observed, the immediate threat is limited to potential future re‑use of the same infrastructure.