6z9csad[.]pages[.]dev

This domain, 6z9csad.pages.dev, operates as a credential harvesting site targeting Gmail users. The page displays a fraudulent Google login interface designed to trick visitors into entering their email addresses and passwords. Analysis indicates the site is actively collecting sensitive account information, which could lead to unauthorized access, data breaches, or further malicious activity such as spam distribution or identity theft. The threat primarily affects individuals who mistake the site for a legitimate Google service due to its visual mimicry of the Gmail login page. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain was registered on April 30, 2025, through Cloudflare, Inc., and is hosted on Google LLC infrastructure (AS15169) at IP address 142.250.185.132. Security vendors have detected the threat, with 2 out of 95 engines on VirusTotal flagging the domain as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. The page title is set to 'Google,' further reinforcing the impersonation attempt. If you or someone you know has visited 6z9csad.pages.dev and entered login credentials, immediate action is required to mitigate potential damage. First, change the password for the affected Gmail account and any other accounts that may use the same or similar credentials. Enable multi-factor authentication (MFA) on the account to add an extra layer of security. Monitor the account for any suspicious activity, such as unauthorized logins or sent emails. If financial or other sensitive information was entered, consider reporting the incident to relevant authorities or identity protection services. Finally, ensure that all devices used to access the phishing site are scanned for malware, as some credential harvesters may deploy additional payloads.