Google account sign-in phishing operator: fake agency meeting lures and Google look-alike domains

An operator of fake Google sign-in pages that take the email address, password and two-step verification code, send them to the operator's own server and then pass the victim on to the real Google account page. The sign-in pages sit behind a Cloudflare interactive check, and the operator fronts them with a copy of a real digital agency's website that invites the visitor to book and join a call. The same operator holds dozens of look-alike domains registered since April 2026 (Google, TikTok, CapCut, Shopify and Telegram look-alikes), among them cmail-geogle[.]com, gooqleinc[.]com, qooqleinc[.]com, goooqle-buissiness[.]com, ads-account[.]com, install-tiktok[.]com, brandogdigital[.]org and brandog[.]digital. A match means a page served by the operator's server (its default site, its tracker panel or its agency copy) or a scan of one of its known hosts.