update-chrome[.]pages[.]dev

Domain update-chrome.pages.dev has been confirmed as an active credential phishing site targeting users with a fake Google Chrome update prompt. This domain impersonates the official Chrome browser update process, aiming to harvest login credentials and other sensitive information under the guise of a necessary software update.

Analysts identified this threat through verified threat intelligence sources. The domain triggered detection engines at VirusTotal, where it was flagged by 1 of 95 participating security vendors. Registered via Cloudflare, Inc., the domain resolves to IP address 188.114.97.3 and utilizes a Let's Encrypt SSL certificate to enhance credibility. The reported creation date precedes recent analysis, and the domain has not yet appeared on major blocklists, though trust scores remain critically low due to active phishing payloads.

As of current analysis, this credential phishing domain remains active and poses an elevated risk to users misled by the false Chrome update page. The domain uses Cloudflare infrastructure and SSL certificates to appear legitimate. Users are advised to avoid interacting with unsolicited update prompts, verify software sources directly from official domains (chrome.google.com), and report suspicious pages to browser vendors and cybersecurity teams. Organizations should update browser policies to block known malicious domains and educate employees on recognizing impersonation tactics in software update lures.