ee3zkwf10wmokqmsuiwwlqq7[.]pages[.]dev

This domain, ee3zkwf10wmokqmsuiwwlqq7.pages.dev, is actively impersonating Google as part of a brand impersonation campaign. Registered through Cloudflare, Inc. on November 20, 2025, the domain resolves to the IP address 142.250.186.164, which is associated with legitimate Google infrastructure, potentially complicating detection efforts. The page title explicitly displays 'Google,' reinforcing its attempt to mimic the targeted brand. Analysis indicates the use of Google Web Server technology, HSTS, and HTTP/3, suggesting an effort to appear technically legitimate. The domain's SSL certificate is issued by Google Trust Services, further blending it with authentic Google properties. As of July 12, 2026, the domain remains active and is flagged by one security blocklist. Three of 95 security vendors on VirusTotal have detected this domain as malicious. The Gridinsoft trust score for this domain is 0/100, indicating a high-risk classification. Defenders should note that the domain is currently blocked by PhishDestroy, which may aid in mitigation. The exact content and functionality of the site have not been fully analyzed, but the combination of brand impersonation, use of legitimate-looking infrastructure, and low detection rates suggests a targeted or evolving threat. Organizations are advised to block this domain at the network level and monitor for any attempts to access it from internal systems. Given the domain's registration under Cloudflare and its use of Google-associated technologies, additional scrutiny of similar subdomains under the pages.dev namespace may be warranted to identify related threats.