home-chrome-extension[.]pages[.]dev

Analysis conducted on July 23, 2026 identifies home-chrome-extension.pages.dev as a high‑risk phishing infrastructure that has been taken offline. The domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.45.33 (AS13335, United States). Cloudflare‑provided DNS servers james.ns.cloudflare.com and tani.ns.cloudflare.com host the name, and the site served an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS configuration. HTTP traffic was forced to use HSTS and HTTP/3, and the server responded with HTTP 403 before the takedown.

Reputation services flag the domain: it appears on one security blocklist, is blocked by PhishDestroy, and Google Safe Browsing classifies it as a social‑engineering threat. VirusTotal recorded 13 positives out of 93 scanned vendors, reinforcing the malicious assessment. Gridinsoft assigned a trust score of 0 / 100, and the page title presented by Cloudflare was “Suspected phishing site | Cloudflare,” confirming that the host had already been identified as a phishing placeholder.

No additional content, brand impersonation details, or payload information were captured before the site went offline, leaving the exact victim‑target profile uncertain. Defenders should continue to block the domain at perimeter controls, monitor for any re‑registration attempts, and add the associated IP range to threat intel feeds. Email gateways and web proxies should enforce URL filtering against the observed indicators, and incident response teams should review recent logs for connections to the domain or its IP address to identify potential compromise attempts.