wabg3c6g8i99xcdw18e4rwde[.]pages[.]dev

This domain, wabg3c6g8i99xcdw18e4rwde.pages.dev, is currently flagged as an active high-risk brand impersonation threat targeting Gmail users. Analysis indicates the site mimics Google’s login interface, presenting a page titled 'Google' to deceive victims into submitting credentials. The campaign is classified as brand_impersonation, with Gmail identified as the primary target. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 20, 2025, and resolves to the IP address 172.253.62.106, located within AS15169 (Google LLC) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a detail often exploited to lend false legitimacy. Detection metrics show the domain is flagged by 3 of 95 security vendors on VirusTotal and appears on one security blocklist. Despite these indicators, the domain remains operational at the time of this report. Current status confirms the domain is still active, posing an ongoing risk to users. Organizations and individuals are advised to block the domain at the network level and implement phishing-resistant authentication methods, such as multi-factor authentication (MFA). Security teams should monitor for credential submission attempts to this domain and conduct retrospective analysis of logs for prior interactions. Users encountering this domain should avoid entering credentials and report the incident to their security operations center for further investigation.