rj85fvlch30pge8c8kbu0zmf[.]pages[.]dev

This domain, rj85fvlch30pge8c8kbu0zmf.pages.dev, operates as a high-risk phishing site designed to impersonate Gmail and harvest user credentials. The page displays the title 'Google' and mimics the legitimate login interface to deceive visitors into entering their email addresses and passwords. Analysis indicates the site is actively targeting users seeking access to their Gmail accounts, posing a significant risk of account compromise and unauthorized access to sensitive communications and data. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 20, 2025, and currently resolves to the IP address 172.253.62.99, associated with Google LLC’s autonomous system (AS15169). The site is flagged by 3 out of 95 security vendors on VirusTotal, including detection by PhishDestroy, and appears on one security blocklist. The SSL certificate, issued by Google Trust Services under the identifier WE1, further suggests an attempt to appear legitimate, though this does not mitigate the malicious intent of the domain. Users who have visited rj85fvlch30pge8c8kbu0zmf.pages.dev or entered credentials on the site should take immediate action. First, reset the password for the affected Gmail account from a secure device, ensuring the new password is unique and complex. Enable multi-factor authentication if not already active. Review recent account activity for any unauthorized logins or suspicious actions, and revoke access for any unfamiliar devices or applications. Additionally, monitor linked accounts for signs of compromise, as attackers may attempt to exploit the stolen credentials across other platforms. If financial or sensitive personal information was exposed, consider reporting the incident to relevant authorities for further guidance.