zillowhelps[.]com

Analysis of zillowhelps.com indicates a phishing domain impersonating Zillow support services, active since its registration on February 21, 2026. The domain resolved to IP 188.114.97.3, hosted on Cloudflare's network (AS13335) in the US, and was served via Cloudflare nameservers deb.ns.cloudflare.com and johnny.ns.cloudflare.com. No SSL certificate was present, increasing the risk of unencrypted credential interception. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, suggesting the site may have employed anti-bot or proxy protections to obscure its content from automated analysis.

As of July 25, 2026, the domain is offline, though it remains flagged by one security blocklist (PhishDestroy) and detected by 3 of 93 vendors on VirusTotal. The registrar, NiceNIC International Group Co., Limited, has been associated with other malicious domains, though no direct evidence links this registrar to the phishing campaign. Defenders should treat this domain as a confirmed phishing threat targeting Zillow users, particularly those seeking support or account-related services.

Recommended actions include blocking the domain and IP at perimeter defenses, monitoring for connections to 188.114.97.3, and alerting users to verify official Zillow communications via documented support channels. Further investigation into related infrastructure, such as co-hosted domains on the same IP or nameservers, may reveal additional threats. Given the domain's recent takedown, historical logs should be reviewed for prior compromise activity.