vk234ooc3f72jeo0qmymld0f[.]pages[.]dev

This domain, vk234ooc3f72jeo0qmymld0f.pages.dev, is actively impersonating Google to conduct credential theft operations. Analysis of the page title, which explicitly displays 'Google,' confirms the intent to deceive users into believing they are interacting with legitimate Google services. Such impersonation typically aims to harvest login credentials, session tokens, or other sensitive authentication data under false pretenses, posing a direct risk to user privacy and account security. Infrastructure analysis reveals the domain was registered on November 20, 2025, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare’s network. Despite its recent creation, the domain has already been flagged on one security blocklist, though it remains undetected by antivirus engines, with a VirusTotal score of 0/95. The use of Cloudflare’s infrastructure provides the operator with anonymity and resilience, complicating takedown efforts and prolonging the domain’s availability for malicious activity. Users who have visited vk234ooc3f72jeo0qmymld0f.pages.dev or entered credentials on the site should immediately revoke any active sessions associated with Google accounts and reset passwords using a secure, unrelated device. Multi-factor authentication (MFA) should be enabled if not already active, and any suspicious login attempts should be reviewed in account activity logs. Organizations are advised to block the domain and its resolving IP at the network perimeter and monitor for indicators of compromise, such as unusual authentication requests or unauthorized access to linked services.