core-helper[.]com

The domain core-helper.com was registered on July 22 2026 through Cloudflare, Inc. and is currently served by the Cloudflare nameservers alberto.ns.cloudflare.com and rayne.ns.cloudflare.com. DNS resolution points to the IP address 104.21.82.158, which belongs to Cloudflare’s global edge network. The domain remains active and appears on a single public security blocklist; it is also listed as blocked by the PhishDestroy feed. VirusTotal has processed the domain with 91 scanning engines, none of which returned a detection at the time of analysis.

No additional intelligence such as page title, targeted brand, or malicious payload has been published, so the exact content hosted on the site cannot be confirmed. The available evidence therefore supports a classification of generic phishing, but the specific victim or brand being spoofed is unknown. Defenders should consider adding core‑helper.com to outbound filtering rules and DNS blocklists, especially for users who may be targeted by credential‑stealing campaigns.

Continuous monitoring of the IP address 104.21.82.158 for anomalous traffic and periodic re‑scans on VirusTotal or similar platforms are recommended to capture any future changes in the domain’s behavior. Because the infrastructure relies on Cloudflare’s CDN, attribution to a single operator is difficult, and threat actors may switch front‑end services without altering the underlying domain. Until further forensic analysis of the hosted content is available, the domain should be treated as high‑risk for credential‑harvesting attempts.