fl0b9u6yhhxuo3khlxcbrdvt[.]pages[.]dev

This domain fl0b9u6yhhxuo3khlxcbrdvt.pages.dev is classified as brand impersonation targeting Gmail. The hosted page mimics a legitimate email login interface and is designed to mislead users into entering credentials under a trusted brand appearance. The infrastructure and content pattern are consistent with credential harvesting operations.

Technical indicators show VirusTotal detection ratio 3/95 security engines. The domain was created November 20, 2025 and remains active at the time of analysis. It resolves to IP 142.251.45.164 associated with a major US autonomous system (AS15169). The domain is listed on 1 security blocklist, confirming external malicious classification.

Despite valid TLS encryption and continued accessibility, the domain remains high-risk due to active impersonation behavior. The current status is active, indicating ongoing exposure to potential victims. Recommended mitigation includes blocking at DNS and web filtering layers, continuous monitoring for credential theft attempts, and ingestion into security detection systems for preventive enforcement.