i84lnrky9e03g709m3218r1q[.]pages[.]dev

This domain, i84lnrky9e03g709m3218r1q.pages.dev, is actively involved in a credential phishing campaign targeting Google users. The domain was registered through Cloudflare, Inc. on September 02, 2020, and currently resolves to the IP address 142.251.163.106, which is associated with AS15169 Google LLC in the United States. Analysis indicates that the domain impersonates Google, as evidenced by the page title 'Google' and the scam type 'Credential Phishing'. The Gridinsoft trust score for this domain is 0/100, reflecting a high level of suspicion.

Despite this, only 3 of 93 security vendors on VirusTotal have flagged this domain, suggesting that it may still evade detection by some security systems. The domain is blocked by PhishDestroy and appears on one security blocklist, indicating that it is recognized as a threat by certain security communities. The SSL certificate for this domain is issued by Google Trust Services, which adds an additional layer of credibility that attackers may leverage to trick users. The website is currently active and returns an HTTP status code 200, confirming that it is accessible and potentially operational.

Technologies detected on the domain include the Google Web Server, HSTS, and HTTP/3. Given the high risk level and the active status of this domain, defenders are advised to block access to i84lnrky9e03g709m3218r1q.pages.dev and monitor for any related malicious activity. User education on recognizing and avoiding phishing attempts should also be emphasized. The exact content of the page has not been fully analyzed, but the available evidence strongly suggests that it is being used to phish credentials from unsuspecting users.