support-home[.]pages[.]dev

This domain, support-home.pages.dev, is identified as a high-risk brand impersonation phishing site targeting Discord users. The domain is currently offline but was actively used to deceive victims into interacting with fraudulent interfaces designed to mimic legitimate Discord services. Analysis of the page title, 'Dex Automate | Simple and secure interface that integrates seamlessly with your browser,' suggests an attempt to lure users into engaging with a malicious crypto-draining tool under the guise of a browser integration. Infrastructure analysis reveals the domain was registered on February 22, 2026, through Cloudflare, Inc., and resolved to the IP address 172.66.44.56, hosted within AS13335 (Cloudflare, Inc.) in the United States. The domain is flagged by 12 of 95 security vendors on VirusTotal and appears on three security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing domains leveraging legitimate certificate authorities to appear trustworthy. The domain was blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious intent. The domain is currently offline, but its infrastructure remains a potential threat vector. Organizations and users are advised to block the domain and its associated IP address (172.66.44.56) at the network level. Security teams should monitor for any re-emergence of the domain or similar patterns, such as newly registered domains under Cloudflare with Discord-related branding. End-users should be educated on recognizing brand impersonation tactics, particularly those involving fake browser integrations or crypto-related tools. If interaction with the domain occurred, immediate steps should include revoking access to any linked accounts, scanning for malware, and resetting credentials for Discord and associated services.