f56uce8up1cpvb90jgxonqfz[.]pages[.]dev

The domain f56uce8up1cpvb90jgxonqfz.pages.dev is a high-risk brand impersonation threat actively targeting Gmail users. PhishDestroy identified this domain as a phishing site that attempts to steal login credentials by mimicking the official Google login page. The page title displayed is 'Google,' which further deceives victims into entering their email and password. No known crypto drainer kit is associated with this specific campaign, but the fraudulent login page poses a serious risk of credential theft.

Technical indicators reveal that the domain was registered on November 20, 2025, through Cloudflare, Inc., and is hosted on IP address 142.250.186.132. The SSL certificate is issued by Google Trust Services / WE1, adding a layer of false legitimacy. VirusTotal analysis shows that 3 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The domain is not listed on Google Safe Browsing (GSB), which means it may not be blocked by Chrome's built-in protection. The site remains active and accessible at the time of analysis.

The phishing site is still operational, and no takedown actions have been reported yet. PhishDestroy advises users to avoid interacting with this domain entirely. If anyone has already entered credentials on this page, they should change their Gmail password immediately and enable two-factor authentication. Organizations should block access to this domain and educate users about verifying URLs before logging in. Always navigate to Gmail by typing 'mail.google.com' directly into the browser rather than clicking on links from emails or search results.