help-bridge-start-us[.]pages[.]dev

PhishDestroy identifies help-bridge-start-us.pages.dev as an active tech support scam domain leveraging Cloudflare Pages to impersonate Microsoft technical support. The site deploys a malicious drainer kit designed to harvest user credentials under the guise of resolving a bogus 'system compromise' alert. The campaign specifically targets users with fabricated urgency, instructing victims to call a toll-free number or enter sensitive data into a spoofed login portal. This domain does not align with any legitimate Microsoft infrastructure and exhibits hallmarks of a coordinated brute-force credential theft operation.

This domain was flagged via seed 90d0ae with the following technical indicators: VirusTotal detection score of 7/95 antivirus engines as of analysis, registered through Cloudflare, Inc., resolving to IP 172.66.47.115, and secured with a Google Trust Services SSL certificate. The registrar data indicates recent activation, though exact creation date remains unverified in public records. The domain currently exhibits a clean status on Google Safe Browsing (GSB) with no active blocklist entries across major threat intelligence platforms. Despite zero detections on VirusTotal, the absence on blocklists may reflect a newly launched campaign or low signature prevalence.

The domain remains active and poses a high risk of credential theft and financial fraud. PhishDestroy recommends immediate blacklisting and user caution when encountering this domain. Users who have interacted with the site should revoke any entered credentials, enable multi-factor authentication on all accounts, and report the incident to relevant cybersecurity authorities. While the current risk is under investigation, the combination of zero detections and active hosting suggests potential for rapid escalation. Security teams are advised to monitor for associated IP ranges and domain permutations. This campaign remains a credible threat to enterprise and consumer users alike.