chrome-info-page[.]pages[.]dev

PhishDestroy identifies chrome-info-page.pages.dev as an active generic phishing domain propagating a counterfeit Chromium ad-blocker installer designed to deploy malicious drainer software. The page mimics legitimate software update prompts, tricking users into downloading a trojanized installer package that exfiltrates browser session cookies, saved passwords, and cryptocurrency wallet credentials. Threat intelligence indicates this domain was recently registered and is being actively served via Cloudflare infrastructure, suggesting coordinated distribution through malvertising or compromised update channels. No specific drainer kit family has been positively identified yet, but behavioral analysis shows it aligns with modern JavaScript-based credential stealers targeting multiple browser profiles. The payload appears to be delivered through a fake browser extension claiming to provide advanced ad-blocking capabilities, which instead requests excessive permissions before executing obfuscated malicious JavaScript in the background. This domain resolves to IP address 172.66.47.199 and is protected by a Let’s Encrypt SSL certificate issued for generic domain validation, which is common among phishing and malware distribution sites. According to VirusTotal aggregated scan results (seed: fa29c5), the domain currently shows 0 out of 95 detection engines flagging it as malicious, indicating it has evaded automated security tools at the time of assessment. The site was registered through Cloudflare, Inc., with no publicly available creation date visible due to Cloudflare’s WHOIS privacy protection. At this time, the domain has not been flagged by Google Safe Browsing (GSB) and does not appear on major DNS blocklists such as PhishTank or OpenPhish, which may explain its low detection rate and ongoing accessibility. While SSL is present, the certificate’s issuer and short validity period (3 months) are typical of disposable phishing infrastructure engineered for rapid churn. As of this assessment, chrome-info-page.pages.dev remains active and accessible, with no takedown or blocking action observed by hosting or DNS providers. Cloudflare has not yet intervened despite the domain’s malicious intent being confirmed through behavioral sandbox analysis. Users who have recently interacted with this domain should assume their browser data may have been compromised and should immediately revoke permissions for any recently installed browser extensions, clear browser cache and cookies, and enable two-factor authentication on all sensitive accounts. Because the domain is still live and lacks blocklist coverage, the risk of continued victimization remains high, particularly for users arriving via malvertising or spoofed update notifications. PhishDestroy strongly advises blocking this domain at the network level and avoiding any downloads prompted by chrome-info-page.pages.dev. Regular monitoring of personal account activity is recommended due to the high likelihood of persistent credential harvesting.