login-utama-setelah-update-google[.]pages[.]dev

This domain, login-utama-setelah-update-google.pages.dev, is actively engaged in credential harvesting by impersonating Google’s authentication portal. The page title, 'AMP - Login Utama Setelah Update Googe Terbaru - Da Awak Bilang,' mimics legitimate Google login prompts, targeting users with Indonesian-language phishing content. The site employs social engineering tactics, such as fake update notifications, to trick victims into entering sensitive credentials, which are then exfiltrated to attacker-controlled infrastructure. Analysis indicates the domain was registered on April 03, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. It is currently flagged by 4 out of 95 security vendors on VirusTotal, with one confirmed entry on a security blocklist. The domain uses a Let’s Encrypt SSL certificate (serial number prefix E8), which, while providing encryption, does not validate legitimacy. Infrastructure analysis reveals the domain leverages Cloudflare’s content delivery network, obscuring the true origin of the malicious server. Users who have visited login-utama-setelah-update-google.pages.dev should immediately revoke any entered credentials, particularly Google account passwords, and enable multi-factor authentication (MFA) on all associated accounts. Network administrators are advised to block the domain and its resolving IP (188.114.97.3) at the perimeter. If browser sessions were active during the visit, clear cached data and run a full antivirus scan to detect potential post-exploitation artifacts. Monitor for unauthorized access or anomalous login attempts originating from the affected accounts.