ptsrs8y4ui09u8m4xxa4xomk[.]pages[.]dev

This domain, ptsrs8y4ui09u8m4xxa4xomk.pages.dev, is actively engaged in brand impersonation targeting Google, a high-risk threat designed to deceive users into believing they are interacting with legitimate Google services. The site mimics Google’s branding, including an identical page title, to facilitate credential harvesting or distribution of malicious payloads. Given the domain’s infrastructure and impersonation tactics, it is likely intended to exploit trust in Google’s ecosystem, potentially leading to unauthorized account access, data exfiltration, or further malware deployment.

Infrastructure analysis reveals multiple technical indicators supporting this assessment. The domain is registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, located in Canada. It was created on November 20, 2025, and is currently flagged by 4 out of 95 security vendors on VirusTotal. Additionally, the domain appears on three independent security blocklists and is actively blocked by multiple threat intelligence platforms. These indicators, combined with its active status and impersonation of a major technology brand, underscore the elevated risk posed by this infrastructure.

Users who have visited ptsrs8y4ui09u8m4xxa4xomk.pages.dev or interacted with its content should take immediate action to mitigate potential risks. First, terminate any active sessions with the domain and clear browser caches to remove residual tracking elements. Next, review account activity for any unauthorized access or suspicious transactions, particularly for Google-associated services. If credentials were entered, reset passwords immediately using a secure, unrelated device. Monitor financial and personal accounts for signs of compromise, and consider enabling multi-factor authentication where available. Organizations should update internal blocklists to prevent access to this domain and conduct a review of network logs for connections to 188.114.96.3 or related indicators.