faqs-trezr-io[.]pages[.]dev

This domain, faqs-trezr-io.pages.dev, has been identified as a credential harvesting phishing site targeting users of cryptocurrency platforms. Analysis indicates the site was designed to mimic legitimate login portals to capture sensitive authentication details. The domain is currently offline, though prior activity suggests it was actively used for fraudulent purposes. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.66.46.224, hosted on AS13335 within the United States. Security vendors flagged the domain as malicious, with 9 of 95 VirusTotal engines detecting phishing-related activity. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The page title, 'Suspected phishing site | Cloudflare,' further corroborates its fraudulent nature. The domain has been taken offline, but users who may have interacted with it should immediately reset credentials for any accounts accessed during the exposure window. Organizations are advised to block the domain and its associated IP (172.66.46.224) at the network perimeter. Monitoring for related domains with similar naming patterns (e.g., 'trezr') is recommended to preempt further phishing attempts.