onxhfhbr5dev711qxmqhedfe[.]pages[.]dev

The domain onxhfhbr5dev711qxmqhedfe.pages.dev is currently active and engaged in brand impersonation, specifically targeting Gmail users. Analysis indicates this infrastructure is designed to deceive visitors into believing they are interacting with legitimate Google services, likely for credential theft or account compromise. The page title explicitly displays 'Google', reinforcing the impersonation attempt. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on November 20, 2025, through Cloudflare, Inc., and resolves to the IP address 142.250.184.228, which is geolocated in the United States under AS15169 (Google LLC). Despite resolving to a Google-owned IP, this is a common tactic to evade detection by blending with legitimate traffic. The domain appears on one security blocklist and is flagged by 3 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), further mimicking authentic Google infrastructure. These indicators collectively suggest a deliberate attempt to exploit trust in the Gmail brand. Current status confirms the domain remains active and operational. Given the high-risk nature of brand impersonation targeting email credentials, immediate action is recommended. Network administrators should block the domain and associated IP at the perimeter. End users should avoid interacting with the site and report any suspicious login prompts to their security teams. Organizations are advised to monitor for similar impersonation attempts, particularly those leveraging Cloudflare-hosted pages with Google-related certificates or IP resolutions. Enhanced email filtering and user awareness training on recognizing brand impersonation tactics are strongly recommended.