ugzxc86[.]pages[.]dev

This domain, ugzxc86.pages.dev, is flagged as an active high-risk brand impersonation threat targeting Google. Registered on April 30, 2025, through Cloudflare, Inc., it resolves to the IP address 142.250.184.196 and presents a page title of 'Google,' directly aligning with the impersonated brand. The domain is currently active and appears on at least one security blocklist, with a Gridinsoft trust score of 0/100. Analysis of the SSL certificate indicates it is issued by Google Trust Services, which may lend an appearance of legitimacy but does not confirm the site's authenticity. Technologies detected include Google Web Server, HSTS, and HTTP/3, which are consistent with legitimate Google infrastructure but are also replicable by threat actors. Two of 95 security vendors on VirusTotal have flagged this domain, though the specific detection context is not detailed. Defenders should treat this domain as malicious and prioritize blocking or monitoring access to it. Given the use of Cloudflare Pages infrastructure, additional scrutiny of similarly structured domains (e.g., *.pages.dev) may be warranted to identify related threats. The exact content and functionality of the site remain unanalyzed, so further investigation is recommended to determine the scope of the phishing operation.