m84mia0353vnzsgj8534xbgt[.]pages[.]dev

This domain has been assessed as a high-risk brand impersonation threat, specifically targeting Gmail users. The site mimics the legitimate Google login page to steal credentials, a common tactic in phishing campaigns. Security analysts have flagged it as active, with no signs of takedown efforts yet.

Technical indicators paint a concerning picture. VirusTotal reports 3 out of 95 security vendors have flagged the domain, placing it on three blocklists. It was registered on November 20, 2025, through Cloudflare, Inc., and resolves to IP address 142.250.185.228. The SSL certificate is issued by Google Trust Services (WE1), adding a veneer of legitimacy. The page title displayed is simply "Google," reinforcing the impersonation of the Gmail brand.

Users encountering this domain should never enter credentials or personal information. The safest mitigation is to avoid interacting with the site entirely and report it to PhishDestroy for analysis. For Gmail access, always navigate directly to mail.google.com rather than following links. Organizations should consider blocking the domain at the network level and educating users about credential harvesting risks.