b975n95pft8zs9plkdl8dnza[.]pages[.]dev

The domain b975n95pft8zs9plkdl8dnza.pages.dev is actively engaged in brand impersonation targeting Gmail users. This infrastructure is designed to harvest login credentials by presenting a fraudulent interface mimicking the legitimate Google email service. The domain remains operational as of the latest verification, posing a high-risk threat to unsuspecting users. Analysis of the domain reveals multiple technical indicators of malicious activity. The domain is flagged by 3 of 95 security vendors on VirusTotal, indicating detection by a subset of the security community. It was registered through Cloudflare, Inc. on November 20, 2025, and resolves to the IP address 142.250.185.132, which is geolocated to the United States under AS15169 (Google LLC). The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title displayed is "Google," further confirming its intent to deceive users into believing they are interacting with a legitimate Gmail login portal. Current infrastructure analysis confirms the domain remains active and continues to resolve. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to prevent access. Users should be educated to scrutinize URLs before entering credentials, particularly those hosted on non-Google domains or subdomains. Monitoring for similar patterns, such as newly registered Cloudflare Pages domains with Google-related page titles, is recommended to identify and mitigate emerging threats. Immediate reporting to relevant security teams and domain registrars is encouraged to facilitate takedown efforts.