tels-ra-helpcenter[.]pages[.]dev

This domain, tels-ra-helpcenter.pages.dev, is flagged as a credential harvesting phishing site targeting users through a fraudulent help center interface. Analysis indicates the threat type is generic_phishing with an elevated risk level, as it employs social engineering tactics to deceive victims into submitting sensitive login credentials. The domain was operational but has since been taken offline following detection. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolved to the IP address 172.66.47.162. It appears on one security blocklist and is flagged by 9 out of 95 security vendors on a malware detection platform. The domain was created on November 04, 2025, and employs a Google Trust Services SSL certificate to lend an appearance of legitimacy. Additional technical indicators include the use of Tailwind CSS, HSTS, Cloudflare Browser Insights, and HTTP/3 protocols. A trust score of 0/100 further corroborates its malicious classification. Mitigation against such credential harvesting threats involves several technical and procedural controls. Network administrators should block the domain and its associated IP address (172.66.47.162) at the perimeter firewall and DNS filtering levels. Endpoint protection systems should be updated to include signatures for this domain and any related artifacts. Users should be educated on recognizing phishing indicators, such as unexpected help center URLs, mismatched SSL certificates, and urgent requests for credentials. Organizations are advised to enforce multi-factor authentication (MFA) to reduce the impact of credential theft, even if initial phishing attempts succeed. Monitoring for similar domains registered under Cloudflare or resolving to the same IP range may help preempt future threats.