oci63u5gyj59iux4cuy7cfdt[.]pages[.]dev

The domain oci63u5gyj59iux4cuy7cfdt.pages.dev has been identified as an active phishing site specifically targeting Gmail users. This brand impersonation threat is currently online and operational, posing a significant risk to anyone who might encounter it. The site presents itself as a Google login page, attempting to harvest credentials from unsuspecting victims.

Technical analysis reveals that the domain was registered on November 20, 2025, through Cloudflare, Inc., and resolves to the IP address 172.253.62.147. It has already been flagged by 12 out of 95 security vendors on VirusTotal, indicating widespread recognition as malicious. Furthermore, the domain appears on at least one security blocklist, and its SSL certificate is issued by Google Trust Services, which may lend it a false sense of legitimacy. The page title displayed is simply "Google," a classic tactic to deceive users into thinking they are on an official site.

Given the high risk level and active status, users are strongly advised to avoid visiting this domain entirely. If you have already interacted with the site, change your Gmail password immediately and enable two-factor authentication. PhishDestroy recommends reporting the domain to your email provider and security tools to prevent further exposure. Stay vigilant against unsolicited login prompts and always verify URLs before entering credentials.