xegroup-de-google-mpo2121.pages.dev

Google

https://xegroup-de-google-mpo2121.pages.dev Access site

Screenshot

Investigate

Domain xegroup-de-google-mpo2121.pages.dev1 CT host on apex

urlscan

page.domain

VirusTotal

Whois

IP 172.66.47.34

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://xegroup-de-google-mpo2121.pages.dev

urlscan

Wayback

archive.today

Cert Let's Encrypt

crt.sh

Censys

Google CT

Phishunt analysis Beta

22 low suspicionheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+5.1 urlscan.io
+1.1 ASN reputation
+1.1 No CSP header
+1.1 No HSTS header
+0.7 Brand in cert SAN
+0.6 Long domain
+0.6 Login text in screenshot
+0.6 Suspicious TLD
+0.5 Young certificate
+0.3 Free CA
+0.3 Hyphens
+0.1 External scripts
+0.1 Deep subdomain

19 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Site hosted on Cloudflare Pages embeds the Google brand in its domain with login-themed keywords in its content. The TLS certificate names the Google brand, and urlscan independently flags it as malicious, consistent with Google account credential harvesting.

Brand in cert SANLogin text in screenshoturlscan.io

AI-generated from stored detector signals - the AI never visited the site. · 2026-08-27 · confidence 77%

Domain & Network

Whois

Registrar CloudFlare, Inc.

Network

IP 172.66.47.34

Country