rwfebmq2qeirpfkk1urahnah[.]pages[.]dev

The domain rwfebmq2qeirpfkk1urahnah.pages.dev was created on 20 November 2025 and is currently listed as offline. When queried, it resolves to the IP address 142.251.179.99, which is owned by AS15169 Google LLC in the United States. The domain is delegated to Cloudflare nameservers savanna.ns.cloudflare.com and syeef.ns.cloudflare.com, and the registration was performed through Cloudflare, Inc. An HTTPS service is presented with a certificate issued by Google Trust Services under the WE1 profile, indicating the use of a legitimate Google‑issued certificate. The site advertises HSTS and supports HTTP/3, and an HTTP request returns a 403 status code, suggesting that the content is not publicly accessible at the time of analysis.

The page title returned is "Google", matching the declared brand target of Google and confirming the classification as a brand‑impersonation campaign. VirusTotal analysis shows that 13 of 95 scanning engines have flagged the domain, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the domain, and the Gridinsoft trust score is 0 out of 100, reflecting an extremely low reputation.

Although the infrastructure uses legitimate Google IP space and a genuine Google certificate, the combination of brand‑targeted page title, elevated vendor detections, and blocklist presence indicates malicious intent. Defenders should continue to monitor the domain for any re‑activation, enforce blocking at DNS and proxy layers, and consider adding the domain to internal blocklists. Further investigation of any associated URLs, payloads, or credential‑harvesting pages should be conducted if the site becomes reachable, and any observed traffic should be correlated with known Google credential‑theft campaigns to refine detection rules.