c8elkzy5jw4jrganjyfvv2gp[.]pages[.]dev

Flagged by 3 out of 95 vendors on VirusTotal, c8elkzy5jw4jrganjyfvv2gp.pages.dev is actively involved in a phishing scheme targeting Gmail users. The domain impersonates both Gmail and Google, aiming to deceive users into divulging sensitive information. Registered through Cloudflare, Inc., and hosted on an IP address associated with Google LLC in the US, this domain presents a credible facade to unsuspecting victims.

The phishing page is titled 'Google' and uses SSL certificates issued by Google Trust Services, adding a layer of perceived authenticity. Despite its recent creation on November 20, 2025, it has already been identified and flagged by PhishDestroy on December 9, 2025. The platform risk score is relatively low at 25/100, indicating a targeted and potentially sophisticated operation.

This domain's presence on a public blocklist, specifically PhishDestroy, highlights its malicious intent. The active status and recent detection suggest it exploits the typical delay in antivirus database updates, making it a fresh threat. The use of a reputable registrar and hosting provider further complicates detection and mitigation efforts. Users encountering this domain should be aware of its potential to collect personal data under the guise of legitimate Gmail communications.