dfuo9fg3on3kljsd74ndcpt7[.]pages[.]dev

This domain, dfuo9fg3on3kljsd74ndcpt7.pages.dev, is actively engaged in brand_impersonation targeting Gmail, a widely recognized email service provider. The domain remains operational and unresolved as of the latest assessment, posing a high-risk threat to users who may mistake it for legitimate Gmail infrastructure. Analysis indicates the page title is explicitly set to 'Google,' further reinforcing the attempt to deceive users into believing the site is affiliated with the authentic service. Infrastructure analysis reveals the domain was registered on November 20, 2025, through Cloudflare, Inc., and resolves to the IP address 142.250.186.100, which is geolocated in Germany under AS15169 (Google LLC). Despite the IP association with a legitimate provider, the domain has been flagged by 3 of 95 security vendors on VirusTotal, indicating detection by multiple independent sources. Additionally, the domain appears on one security blocklist and utilizes an SSL certificate issued by Google Trust Services (WE1), which may lend an air of legitimacy to unsuspecting users. The creation date and blocklist inclusion further corroborate the malicious intent behind this infrastructure. The domain remains active and poses a significant risk of credential theft or unauthorized account access. Organizations and users are advised to block this domain at the network level and implement strict email filtering rules to prevent exposure. Security teams should monitor for any attempts to access this domain from internal networks and conduct retrospective analysis to identify potential prior interactions. End-users should be educated on verifying domain authenticity before entering sensitive information, particularly when redirected from unsolicited communications.