hs2hntk1rhly1kb98umiqmm7[.]pages[.]dev

This domain, hs2hntk1rhly1kb98umiqmm7.pages.dev, poses a high-risk brand impersonation threat specifically targeting Gmail users. The infrastructure is designed to deceive visitors into believing they are interacting with legitimate Google services, as evidenced by the page title 'Google' and the use of a Google Trust Services SSL certificate. The domain is structured to harvest credentials or distribute malicious payloads under the guise of a trusted platform, leveraging the familiarity of the Gmail brand to lower user vigilance. Analysis indicates the threat is particularly dangerous due to its active status and the sophistication of its impersonation tactics. Infrastructure analysis reveals concrete indicators of malicious intent. The domain was registered on September 02, 2020, through Cloudflare, Inc., and currently resolves to the IP address 142.251.221.68, which is geolocated in India under AS15169 (Google LLC). Despite the IP association with a legitimate provider, the domain appears on three security blocklists and is flagged by 8 out of 95 security vendors on VirusTotal. The SSL certificate, issued by Google Trust Services (WE1), further complicates detection by mimicking legitimate Google infrastructure, though the domain itself is not affiliated with Google. Users who have visited hs2hntk1rhly1kb98umiqmm7.pages.dev should take immediate remedial actions. First, terminate any active sessions on the domain and avoid entering credentials or downloading files. Clear browser cache, cookies, and stored passwords for the site to prevent persistent access. Run a full system scan using updated security tools to detect potential malware or unauthorized access. If credentials were entered, reset passwords for Gmail and any associated accounts, and enable multi-factor authentication where available. Monitor accounts for suspicious activity, such as unauthorized logins or sent messages, and report the incident to relevant security teams for further investigation.