proj-914790-6koc[.]pages[.]dev

This domain is assessed as a brand impersonation infrastructure targeting Google, with analysis indicating a cloned authentication-style interface designed to mislead users into interacting with fake login or data capture workflows. The page title is set to "Google", suggesting deliberate visual and branding mimicry to increase credibility and induce credential submission. Hosting on pages.dev infrastructure combined with Cloudflare fronting allows rapid deployment of deceptive replicas under trusted TLS and CDN layers, complicating automated detection and increasing user exposure risk.

Evidence indicates mixed trust signals and emerging malicious classification. VirusTotal reports 0/95 security vendor detections at the time of analysis, indicating no broad signature-based detection yet. The domain is registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and is associated with AS13335 Cloudflare, Inc. infrastructure. The domain was created on May 26, 2025. SSL certificates are issued by Google Trust Services (WE1). Despite the absence of VirusTotal detections, the domain appears on 1 security blocklist and is actively blocked by PhishDestroy, indicating behavioral or heuristic-based risk recognition.

Users who may have interacted with this domain should treat any entered credentials as compromised and immediately perform password resets on affected accounts. Multi-factor authentication should be enabled where possible, and session tokens should be revoked to prevent unauthorized access persistence. Endpoint and browser security scans are recommended to identify potential credential interception or session hijacking artifacts. Continued monitoring for phishing variants under similar pages.dev subdomains is advised due to infrastructure reuse patterns.