heyjusthelp[.]pages[.]dev

This domain is flagged as a high-risk credential harvesting phishing site targeting user authentication credentials. Analysis indicates the domain was specifically designed to mimic legitimate login portals, likely for financial or corporate account compromise. The threat type is classified as generic_phishing with a focus on credential theft, as evidenced by the page structure and historical content patterns. Infrastructure analysis reveals the domain heyjusthelp.pages.dev was registered on October 02, 2025, through Cloudflare, Inc. and resolves to the IP address 172.66.46.213 (AS13335, United States). The domain appears on one security blocklist and is currently offline, though it previously displayed a page title of 'Suspected phishing site | Cloudflare.' VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted sites. Google Safe Browsing has explicitly flagged this domain for phishing activity. Mitigation steps for this threat include immediate blocking of the domain and its resolving IP (172.66.46.213) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems to prevent access attempts. User awareness training should emphasize recognizing credential harvesting tactics, particularly those leveraging Cloudflare-hosted subdomains. Security teams are advised to monitor for authentication attempts from internal IPs that previously accessed this domain, as compromised credentials may still be in use. Given the domain's recent creation date, proactive hunting for similar patterns (e.g., pages.dev subdomains with recent registration dates) is recommended to identify related threats.