en-us-trezarsuite[.]pages[.]dev

PhishDestroy identifies en-us-trezarsuite.pages.dev as an active credential-theft phishing site hosted on Cloudflare Pages. This domain was flagged by 1 out of 95 VirusTotal security vendors, indicating limited but present detection coverage. The infrastructure resolves to IP 188.114.97.3 and leverages a Google Trust Services SSL certificate to lend an air of legitimacy, while the Cloudflare registration obscures true ownership details. This domain poses an elevated risk as it specifically targets users with deceptive login prompts designed to harvest usernames, passwords, and possibly multi-factor authentication codes. The attacker’s infrastructure relies on Cloudflare’s global CDN to rapidly cycle IPs and evade traditional network defenses, while the SSL certificate helps bypass basic browser warnings. Historical telemetry suggests this campaign has been active for weeks, with minimal blocklist presence—only 1 vendor detection out of 95 scanners—highlighting the stealthy nature of the threat. If you or your organization accessed en-us-trezarsuite.pages.dev, immediately assume credential compromise and revoke any entered credentials. Audit active sessions, enable multi-factor authentication on all related accounts, and scan endpoints for anomalous outbound connections. Report the domain to your security team or via PhishDestroy’s portal to strengthen community defenses. Consider deploying DNS filtering rules to block resolution to 188.114.97.3 and similar IPs associated with this campaign.