fx0ba3l4lqueq0pkj83owdkw[.]pages[.]dev

The domain fx0ba3l4lqueq0pkj83owdkw.pages.dev was registered on November 20, 2025 through Cloudflare, Inc. and resolves to the IP address 172.253.62.105, which is owned by Google LLC (AS15169) in the United States. DNS resolution is served by Cloudflare name servers aisha.ns.cloudflare.com and kenneth.ns.cloudflare.com, and the site is protected by Cloudflare‑provided HTTP/3 and HSTS. An SSL certificate issued by Google Trust Services under the identifier WE1 is present, indicating that the TLS handshake terminates with a Google‑issued certificate despite the domain not being owned by Google. The HTTP response currently returns a 403 status code, and the site is reported as taken offline at the time of analysis.

Page metadata reports a title of "Google," which aligns with the observed SSL issuer but does not confirm any legitimate Google content. The domain is classified as a brand impersonation targeting Gmail, and Google Safe Browsing flags it for social engineering. Security telemetry shows the domain appears on one blocklist and is blocked by PhishDestroy, while the Gridinsoft trust score is 0 out of 100. VirusTotal analysis records nine of ninety‑five scanners flagging the domain as malicious, reinforcing the suspicion of abuse.

Although the actual payload or page content has not been captured, the combination of brand‑related title, impersonation label, low trust score, blocklist presence, and multiple vendor detections provides strong evidence of malicious intent. Defenders should add the domain to network and email filtering rules, monitor DNS queries for the associated IP range, and consider broader threat‑intel sharing to prevent credential‑ harvesting attempts against Gmail users. Continuous re‑evaluation is advised in case the site returns to an active state or new indicators emerge.