uyghdn1[.]pages[.]dev

This domain, uyghdn1.pages.dev, is actively impersonating Google as part of a brand impersonation phishing campaign. Registered on April 30, 2025, through Cloudflare, the domain resolves to IP address 104.21.37.228, hosted on AS13335 (Cloudflare, Inc.) in the United States. The page title is explicitly 'Google,' aligning with the identified scam type of brand impersonation. The domain is served via Cloudflare Pages infrastructure, utilizing nameservers kyree.ns.cloudflare.com and evangeline.ns.cloudflare.com. Analysis indicates the site is operational, returning an HTTP 200 status, and employs technologies including Google Web Server, HSTS, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1), which may lend an appearance of legitimacy but is not indicative of trustworthiness in this context. The domain has been flagged by at least one security vendor on VirusTotal and appears on one security blocklist, with PhishDestroy currently blocking it. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. Defenders should treat this domain as high-risk. The use of Cloudflare infrastructure complicates takedown efforts, but the domain's active status and clear impersonation of a major brand warrant immediate blocking at the network and endpoint levels. Additional monitoring for related domains using similar naming patterns or Cloudflare Pages infrastructure is recommended. The exact content and functionality of the phishing page remain unanalyzed, but the combination of brand impersonation, active status, and low detection thresholds confirms its malicious intent.