help-chrome-extension[.]pages[.]dev

The domain help-chrome-extension.pages.dev was created on February 21, 2026 and is currently taken offline, returning an HTTP 403 status. Infrastructure analysis shows the domain resolves to IP 172.66.45.23, which is owned by AS13335 Cloudflare, Inc. and located in the United States. Registration data indicates the domain was provisioned through Cloudflare, Inc., and the authoritative nameservers are james.ns.cloudflare.com and tani.ns.cloudflare.com. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), confirming the use of Cloudflare’s default TLS configuration, and the connection is protected by HSTS and HTTP/3.

Google Safe Browsing has flagged the domain for social engineering, and the page title returned by the server is "Suspected phishing site | Cloudflare," reinforcing the phishing classification. Independent security vendors have raised concerns: 14 of 95 VirusTotal scanners flag the domain, Scamadviser assigns a trust score of 1 / 100, Gridinsoft scores it 0 / 100, and the domain appears on one external blocklist. PhishDestroy has also listed the domain as blocked. While the site is offline, the combination of a recent registration date, low trust scores, multiple vendor detections, and explicit Safe Browsing warnings provides concrete evidence of a high‑risk phishing operation.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms because the page content was not captured before takedown. Defenders should immediately block the domain and its associated IP address at network perimeters, update intrusion‑prevention signatures to include the observed SSL fingerprint and nameserver pattern, and monitor for any re‑hosting attempts on other Cloudflare‑provided IP ranges. Continuous threat‑intel feeds should be consulted for any resurgence, and any internal alerts referencing this domain should be treated as confirmed malicious activity.