dilinawzxc[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Gmail users. Analysis indicates the infrastructure is designed to harvest login credentials by presenting a fraudulent Google login interface, as evidenced by the page title 'Google' and confirmed impersonation of Gmail services. Infrastructure analysis reveals the domain dilinawzxc.pages.dev was registered on May 05, 2025, through Cloudflare, Inc. It resolves to IP address 142.250.185.132, located within AS15169 (Google LLC), suggesting potential abuse of legitimate hosting services. The SSL certificate is issued by Google Trust Services (WE1), which may lend false credibility to the phishing page. Security vendors on VirusTotal flag this domain at 13/95, and it appears on one security blocklist. Despite these detections, the domain remains active as of the latest verification. Mitigation requires immediate blocking of dilinawzxc.pages.dev at network and endpoint levels. Organizations should deploy email and web filtering rules to prevent user access, particularly for those handling sensitive accounts. Users should be trained to verify domain authenticity before entering credentials, especially when redirected to login pages. Security teams should monitor for indicators of compromise, including unusual authentication attempts from the identified IP address or associated infrastructure. If credentials were entered, affected accounts must be secured through password resets and multi-factor authentication enforcement.