zw8reg6pbfut5rxelqrrhf0f[.]pages[.]dev

This domain is flagged as a high-risk credential harvesting site targeting Gmail users. Analysis indicates the page mimics Google's login interface, presenting a fraudulent authentication portal designed to capture usernames, passwords, and potentially multi-factor authentication codes. The threat specifically exploits brand recognition of Gmail to deceive users into submitting sensitive account credentials, which could lead to unauthorized account access, data exfiltration, or further phishing campaigns launched from compromised accounts. Infrastructure analysis reveals the domain was registered on November 20, 2025, through Cloudflare, Inc., and currently resolves to the IPv6 address 2607:f8b0:4004:c07::6a within Google LLC's network (AS15169). The SSL certificate is issued by Google Trust Services (WE1), adding a layer of apparent legitimacy. Detection metrics show 3 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain appears on one security blocklist and is actively blocked by at least one enterprise security provider. The page title is set to 'Google,' further reinforcing the impersonation attempt. Users who visited this domain should immediately reset their Gmail credentials from a verified Google login page. If any credentials were entered, enable multi-factor authentication and review account activity for unauthorized access or sent messages. Check connected applications and revoke access for any unfamiliar services. Network administrators should block the domain and its resolving IP address at the perimeter. Monitor for subsequent phishing attempts, as compromised accounts are frequently used to target contacts within the victim's address book.