playzxc1[.]pages[.]dev

This domain, playzxc1.pages.dev, poses a high-risk credential theft threat by impersonating Gmail's login interface. Visitors to the site are presented with a fraudulent page titled 'Google,' designed to harvest usernames and passwords. The site exploits visual mimicry of legitimate authentication portals, tricking users into entering sensitive account details under false pretenses. Analysis indicates this is a targeted brand impersonation campaign, with the potential to compromise personal and corporate email accounts if credentials are disclosed. Infrastructure analysis reveals the domain was registered on May 5, 2025, through Cloudflare, Inc., and currently resolves to the IP address 142.250.186.164, which is associated with Google LLC (AS15169). Detection metrics show that 2 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The SSL certificate, issued by Google Trust Services (WE1), further obscures the site's illegitimacy by presenting a seemingly valid encryption layer. The domain appears on one security blocklist and remains active as of the latest verification. Users who have visited playzxc1.pages.dev should immediately cease all interaction with the site and change their Gmail account password using a separate, trusted device. Enable multi-factor authentication (MFA) to add an additional layer of security. Monitor the account for unauthorized access or suspicious activity, such as unfamiliar sent emails or login attempts from unrecognized locations. If credentials were entered, consider revoking access to any connected third-party applications and notifying relevant security teams. Organizations should update their web filtering rules to block this domain and its associated IP address to prevent further exposure.