v36u3sz3tky3x32jotndmgbo[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting Gmail users. The site presents a fraudulent login interface designed to harvest credentials by replicating the appearance of legitimate Google services. Visitors are tricked into entering sensitive information, which is then captured by threat actors for unauthorized access to accounts, data theft, or further malicious activity such as phishing campaigns or financial fraud. Analysis indicates the domain was created on September 02, 2020, and is registered through Cloudflare, Inc. It is hosted on infrastructure associated with Google LLC (AS15169) and resolves to the IP address 172.253.122.105. The SSL certificate is issued by Google Trust Services under the WE1 root, which may lend a false sense of legitimacy to unsuspecting users. Security vendors on VirusTotal have detected this domain, with 4 out of 95 flagging it as malicious. Additionally, it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious nature. If a user has visited this domain or entered credentials, immediate action is required. First, change the password for the affected Gmail account and any other accounts sharing the same credentials. Enable multi-factor authentication (MFA) to add an additional layer of security. Review the account for unauthorized activity, such as sent emails, login attempts, or changes to settings. If financial or sensitive data was exposed, monitor for signs of identity theft or fraud. Users should also clear browser cache and cookies to remove any residual tracking mechanisms. Finally, report the domain to security teams or platforms for further investigation and mitigation.