msmw91kg[.]pages[.]dev

This domain, msmw91kg.pages.dev, is actively engaged in brand impersonation targeting Google, a high-risk threat designed to deceive users into disclosing sensitive credentials or personal information. The page title explicitly replicates Google's legitimate domain (https://www.google.com/), increasing the likelihood of successful phishing attempts. Infrastructure analysis reveals the domain is hosted on Cloudflare's network, a common tactic to obscure malicious activity behind legitimate CDN services. Evidence supporting the malicious classification includes detection by 7 out of 95 security vendors on VirusTotal, registration through Cloudflare, Inc., and a creation date of May 25, 2025. The domain resolves to the IP address 104.21.12.175, located in the US under AS13335 (Cloudflare, Inc.). It appears on one security blocklist and is flagged for impersonating Google. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimate infrastructure to evade detection. Users who have visited msmw91kg.pages.dev should immediately terminate any active sessions and clear browser cache or cookies associated with the domain. Credentials entered on this site must be considered compromised and reset across all platforms where identical or similar passwords were used. Network administrators are advised to block the domain and its resolving IP (104.21.12.175) at the perimeter. Monitoring for unusual authentication attempts or data exfiltration from affected accounts is recommended for at least 30 days post-exposure.