uukcegxc5pzlkxvfrrmngz0l[.]pages[.]dev

PhishDestroy has identified a high-risk brand impersonation campaign targeting Gmail users, hosted on the domain uukcegxc5pzlkxvfrrmngz0l.pages.dev. This threat is currently active and poses a direct risk of credential theft by masquerading as the official Google login page, as evidenced by its page title of "Google." Users encountering this domain should treat it as a malicious attempt to harvest sensitive account information.

Technical analysis reveals that the domain was created on November 20, 2025, and resolves to IP address 142.251.141.68. It is registered through Cloudflare, Inc., and has been flagged by 3 out of 95 security vendors on VirusTotal, in addition to appearing on 3 security blocklists. These indicators, combined with its low trust score, confirm its malicious nature. The domain's use of a legitimate hosting service and IP address underscores the importance of scrutinizing URLs before entering credentials.

To mitigate this threat, users should never enter their Gmail credentials on any page accessed via this domain. Always verify the URL in the address bar before logging in, ensuring it begins with "https://accounts.google.com." Enable two-factor authentication on your Google account to add an extra layer of security. If you have already entered credentials on this site, change your password immediately and report the incident to Google's security team. PhishDestroy recommends using a password manager to detect lookalike domains and staying vigilant against unsolicited login prompts.