w24r7p8tqao8nb08txa88v5f[.]pages[.]dev

The domain w24r7p8tqao8nb08txa88v5f.pages.dev actively impersonates Gmail, leveraging its association with Google brands to deceive users. Detected by 3 out of 95 vendors on VirusTotal, this phishing domain is flagged as malicious and listed on one public blocklist, including PhishDestroy. The domain was created on November 20, 2025, and PhishDestroy identified it on December 9, 2025.

Hosted on an IP address associated with Google LLC in the US, the domain benefits from the credibility of Google's infrastructure. The SSL certificate issued by Google Trust Services further adds to the deceptive appearance of legitimacy. The page title simply reads "Google," a tactic to reinforce the illusion of authenticity and lure unsuspecting users into the phishing trap.

This phishing operation targets Gmail users through email scams, aiming to harvest sensitive information. The platform risk score of 25/100 indicates a moderate threat level, suggesting the domain is part of a broader phishing campaign. The impersonation of well-known brands like Gmail and Google makes this domain particularly dangerous, as it exploits users' trust in these brands.

Phishing domains like w24r7p8tqao8nb08txa88v5f.pages.dev exploit the initial registration period to evade detection, capitalizing on the window before antivirus databases update. PhishDestroy's proactive detection pipeline identifies such threats in this critical period, providing an early warning before they become widely recognized by traditional security measures.