testy123[.]pages[.]dev

Analysis of testy123.pages.dev indicates that the domain was actively used for a Google brand impersonation campaign before being taken offline. The site resolved to IP 172.66.44.215, which belongs to AS13335 Cloudflare, Inc., and was served from Cloudflare’s infrastructure using HSTS and HTTP/3. The page title returned by the web server was "Suspected phishing site | Cloudflare" and the HTTP response code was 403, suggesting that the content is no longer publicly accessible. Registration data shows the domain was created on September 09, 2024 and was registered through Cloudflare, Inc., with authoritative nameservers igor.ns.cloudflare.com and nina.ns.cloudflare.com.

Multiple security vendors have flagged the domain; VirusTotal recorded 12 of 94 scanners marking it as malicious, and Google Safe Browsing listed it as a social engineering threat. The domain appears on three external blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the high‑risk assessment. Gridinsoft assigned a trust score of 0 out of 100, indicating a complete lack of credibility.

While the exact landing page content beyond the title has not been captured, the combination of brand impersonation, malicious detection counts, blocklist listings, and a zero trust score provides sufficient evidence to classify the domain as a confirmed phishing vector targeting Google users. Defenders should immediately block testy123.pages.dev at DNS and proxy layers, add the associated IP address 172.66.44.215 to network‑level deny lists, and monitor for new subdomains under the pages.dev namespace that exhibit similar registration patterns. Continuous ingestion of blocklist updates and periodic re‑scanning of the IP range are recommended to detect any resurgence of the campaign.