ok3ogj6smer4bb4h5fqeghqu[.]pages[.]dev

This domain, ok3ogj6smer4bb4h5fqe.pages.dev, is actively impersonating Gmail to deceive users into entering their login credentials. The site presents a fake Google login page, complete with the legitimate 'Google' page title, to trick visitors into believing they are accessing an official service. Once credentials are entered, they are captured by threat actors and can be used for unauthorized account access, identity theft, or further phishing campaigns targeting contacts within the compromised account. Analysis indicates this domain was registered on November 20, 2025, through Cloudflare, Inc., and is hosted on infrastructure associated with Google LLC (AS15169). Despite its recent creation, the domain has already been flagged by 3 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), further complicates detection by end-users, as it mimics the cryptographic signatures of legitimate Google properties. The domain resolves to the IP address 142.251.40.132, located in the United States, which is consistent with Google's hosting infrastructure but does not guarantee legitimacy. If you or someone in your organization has visited ok3ogj6smer4bb4h5fqe.pages.dev and entered login credentials, immediate action is required. First, change the password for the affected Gmail account and any other accounts using the same credentials. Enable multi-factor authentication (MFA) if not already active, using an authenticator app or hardware key rather than SMS-based verification. Review the account for unauthorized activity, including sent emails, filters, or connected applications. Report the incident to your organization's security team or, if acting independently, to the platform's abuse reporting system. Monitor financial and communication accounts for signs of compromise, as stolen credentials may be exploited across multiple services.