ac-5uh[.]pages[.]dev

PhishDestroy identifies ac-5uh.pages.dev as an active phishing campaign impersonating Google login portals to harvest user credentials. The domain is currently under investigation with a provisional risk classification of high due to its active status and lack of blocklist coverage. This campaign specifically targets Google account holders by mimicking official login interfaces, aiming to deceive users into entering sensitive authentication details on a fraudulent page hosted under a Cloudflare Pages subdomain.

This domain was flagged for hosting a credential harvesting phishing page and exhibits multiple indicators of malicious intent. VirusTotal analysis shows 0 detections out of 95 engines as of latest scan, indicating undetected threat activity. It resolves to IP address 188.114.96.3, registered through Cloudflare, Inc., leveraging Google Trust Services SSL certificates to enhance perceived legitimacy. The SSL certificate issuance suggests an attempt to bypass security warnings in browsers. No evidence of blocklist inclusion has been observed, and the domain remains active as of investigation timestamp with seed f422f7.

Users and organizations should immediately block ac-5uh.pages.dev at network and endpoint levels due to its confirmed phishing activity. Implement browser security policies prohibiting access to non-standard Google login domains and enforce multi-factor authentication to mitigate credential theft impact. Security teams should inspect DNS logs for connections to 188.114.96.3 and scan endpoints for unauthorized data transmission to external domains. Report the domain to Google Safe Browsing and Cloudflare Abuse teams using submission portals. Monitor internal accounts for suspicious login activity from unfamiliar IPs or devices. Educate users to verify URLs before entering credentials, especially those containing unusual subdomains or non-standard domains claiming to be Google services.