msv04xb6m46roiu4xsakkmjr[.]pages[.]dev

This domain, msv04xb6m46roiu4xsakkmjr.pages.dev, is actively engaged in brand impersonation targeting Gmail, a widely recognized email service provider. Analysis indicates the site mimics legitimate Google login interfaces, likely designed to harvest user credentials through deceptive input forms. The page title 'Google' further reinforces the impersonation, attempting to exploit user trust in the targeted brand. No evidence of cryptocurrency drainer functionality has been observed, but the credential theft risk remains critical due to the high-value nature of email accounts. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on November 20, 2025, and resolves to the IP address 172.217.18.4, geolocated to the United States under AS15169 (Google LLC). The domain appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal, indicating moderate but growing detection. The SSL certificate is issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to unsuspecting users. No Google Safe Browsing (GSB) listing is currently recorded, though this does not diminish the confirmed phishing activity. As of the latest assessment, the domain remains active and unmitigated, posing an ongoing threat to users who may encounter it through phishing emails, malicious advertisements, or compromised redirects. Immediate response actions are recommended, including browser-based blocking, network-level filtering, and user education to recognize brand impersonation tactics. The remaining risk is classified as high due to the domain's operational status, low detection rate, and direct targeting of sensitive account credentials. Organizations should prioritize monitoring for related indicators of compromise, such as unusual login attempts or unauthorized email forwarding rules.