t7xwxv1q4d81anjtgrprth1r[.]pages[.]dev

This domain, t7xwxv1q4d81anjtgrprth1r.pages.dev, is actively flagged as a high-risk credential phishing site impersonating Google. Registered on November 20, 2025, through Cloudflare, the domain resolves to IP 216.58.212.132 (AS15169, Google LLC) and uses Cloudflare nameservers (ethan.ns.cloudflare.com, tia.ns.cloudflare.com). The page title explicitly displays 'Google,' aligning with the identified brand impersonation target. Analysis indicates the site employs reCAPTCHA and HTTP/3, common in phishing infrastructure to evade detection and appear legitimate. The SSL certificate is issued by Google Trust Services (WE1), which may contribute to user trust despite the malicious intent. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and is blocked by at least one security vendor (PhishDestroy). It appears on one security blocklist, and three of 95 security vendors on VirusTotal flag it as malicious. The Gridinsoft trust score is 0/100, further supporting its classification as a phishing threat. No evidence of a specific phishing kit or additional scam categorization (e.g., crypto, investment) is present in the available data. Defenders should treat this domain as a confirmed phishing threat targeting Google credentials. Immediate blocking at the DNS or network level is recommended, along with monitoring for related infrastructure (e.g., sibling domains under the same registrar or nameservers). Given the use of Cloudflare and Google-hosted infrastructure, additional scrutiny of similarly structured domains is advised. The exact content or functionality of the phishing page has not been analyzed, but the combination of brand impersonation, active status, and security vendor detections warrants high-priority mitigation.