b84nsgorbwfp5gfa288fbmqp[.]pages[.]dev

This domain, b84nsgorbwfp5gfa288fbmqp.pages.dev, is flagged as a high-risk credential theft operation targeting Gmail users. Analysis indicates the infrastructure is designed to mimic the Google login interface, as evidenced by the page title 'Google' and the domain's association with known brand impersonation tactics. The threat type is classified as brand impersonation, specifically focusing on harvesting user credentials through deceptive login prompts. Infrastructure analysis reveals the domain was registered on November 20, 2025, through Cloudflare, Inc., and resolves to the IP address 216.58.206.68, located in Germany under AS15169 (Google LLC). The domain is currently detected by 3 out of 95 security vendors on VirusTotal and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which may contribute to the domain's perceived legitimacy. Despite these technical indicators, the domain has not been flagged by Google Safe Browsing at the time of assessment. The domain remains active and poses a significant risk to users who may be deceived by its authentic appearance. Response actions should include immediate blocking of the domain across security gateways and endpoint protection systems. Users are advised to verify the legitimacy of login pages by checking the URL for discrepancies and enabling multi-factor authentication to mitigate the risk of credential theft. Given the domain's persistence and the use of reputable infrastructure, continued monitoring is recommended to prevent further exploitation.