started-eng-traizor[.]pages[.]dev

PhishDestroy identifies an active phishing domain, started-eng-traizor.pages.dev, mimicking a legitimate login portal to harvest credentials. This domain poses an elevated risk due to its current misuse in credential-stealing attacks. Users interacting with this page risk exposing sensitive authentication details to threat actors, who may leverage them for further exploitation, such as account takeover or lateral movement within compromised networks. This domain was flagged by 16 out of 95 security vendors on VirusTotal, indicating widespread suspicion of malicious activity. Registered through Cloudflare, Inc., it resolves to IP 172.66.44.157 and operates under a Google Trust Services SSL certificate, which may lend false legitimacy to unsuspecting victims. The use of Cloudflare Pages as a hosting platform further obscures the domain’s origin, complicating detection for traditional security measures. While specific creation dates and additional blocklist data are not provided, the combination of low vendor detection rates and trusted infrastructure underscores its potential danger to unwary users. To mitigate exposure to this threat, organizations should immediately block the domain started-eng-traizor.pages.dev and its associated IP, 172.66.44.157, at the network perimeter via DNS sinkholing or firewall rules. Users must be warned against entering credentials into untrusted login portals, especially those hosted on cloud service providers like Cloudflare Pages. Security teams should cross-reference this domain with internal logs for any historical or ongoing connections, and consider deploying behavioral analytics to detect anomalous authentication attempts. Proactive threat hunting, including searches for similar domains or certificate reuse, is recommended to uncover related infrastructure.