Fake 'Security Center' password-expiry email leads to Gmail clone on an edgeone.dev subdomain
MalwareTips warns of a "Security Center" email claiming your password is about to expire; its "Keep My Current Password" button led to a fake Gmail login on an edgeone.dev subdomain.
- First reported
- Reports
- 1
Source: malwaretips.com · published
What happened
MalwareTips reported on October 14, 2026 on a "Security Center Password Expiring Soon" email scam. The message warns that a password is nearly expired and offers a "Keep My Current Password" button.
A reported destination was vocational-white-5xciizxu.edgeone.dev, which displayed an imitation Gmail login page. The scam used one subdomain on the edgeone.dev hosting platform; MalwareTips notes that neither the hosting platform nor Google's branding makes the request authorised. Google was impersonated, not involved. MalwareTips said the hosted page now returns a not-found screen.
How the scam works
The email combines a deactivation threat with a convenient shortcut: instead of changing your password, you just confirm you want to keep it. That feels low-risk, but the fake confirmation page collects the existing password just as a fake reset page would.
A department name like "Security Center" printed in an email doesn't identify the sender, and a Google logo doesn't make an unrelated web address genuine. The expiry date creates pressure to act quickly, often when people are busy.
If the account is managed by an employer, a real password policy may exist, but the correct process comes from the help desk, not an unverified email button.
Source
MalwareTips, "Security Center Password Expiring Soon Email Scam" (October 14, 2026).
Red flags
- Password-expiry warnings with a one-click "keep my password" button.
- A login page whose web address is not your email provider's domain.
- Generic sender names like "Security Center".
If you were targeted
- 1Don't use the email's button. Open your email service yourself to check for any real security task.
- 2If you entered your password, change it immediately, sign out other sessions and turn on two-step verification.
- 3Check for unfamiliar forwarding rules or recovery settings in the account.
- 4For work accounts, report the email to your IT help desk.