kxvlkzw3yfm55on0xtx0tw1k[.]pages[.]dev

The domain kxvlkzw3yfm55on0xtx0tw1k.pages.dev has been identified as a high-risk phishing site engaging in brand impersonation, specifically targeting Gmail users. This threat is significant due to its potential to deceive users into providing sensitive information, such as login credentials, by masquerading as a legitimate Google page.

Evidence supporting this assessment includes a detection by 3 out of 95 security vendors on VirusTotal, indicating some level of recognition by threat detection systems. The domain is registered through Cloudflare, Inc., and was created on November 20, 2025. Currently, the domain is still active and listed on one security blocklist, suggesting ongoing malicious activity. The SSL certificate associated with this domain is issued by Google Trust Services / WE1, adding a layer of deceptive authenticity to the phishing site. The IP address, 192.178.155.106, resolves to a location in the United States under AS15169 Google LLC, further enhancing the appearance of legitimacy.

Users who have visited this domain should immediately change their Gmail passwords and enable two-factor authentication to protect their accounts. It is crucial to monitor for any unauthorized account activity and report suspicious emails to their email provider. Additionally, users should ensure that their security software is up to date and consider running a full system scan to detect any potential malware that may have been inadvertently downloaded. Staying informed about phishing tactics and recognizing signs of impersonation can help mitigate future risks.