treizr-io-en[.]pages[.]dev

PhishDestroy identifies treizr-io-en.pages.dev as an active credential-harvesting domain operating under Cloudflare’s Pages service. This subdomain-hosted website mimics legitimate login interfaces to deceive users into surrendering sensitive authentication data, including wallet passphrases and API keys. The infrastructure leverages Cloudflare’s global CDN (IP 172.66.44.215) and a Google Trust Services SSL certificate to appear trustworthy, while its primary objective remains unauthorized credential exfiltration for subsequent financial exploitation.

The domain exhibits multiple red flags consistent with fledgling phishing campaigns. VirusTotal analysis confirms zero detections from 95 security engines, indicating evasion of current detection signatures. It operates through Cloudflare, Inc., which provides anonymity to malicious actors via proxying and DDoS protection layers. While the exact creation timestamp is not publicly available, the active status suggests recent deployment. Analysts should note its alignment with “pages.dev” infrastructure—commonly abused for low-cost, rapid deployment of spoofed portals.

Users who have interacted with this domain should immediately revoke any credentials entered, disconnect connected wallets, and scan local systems for malware. Do not enter sensitive data even if the site appears legitimate, as SSL certificates and CDNs are routinely weaponized to bypass browser warnings. For ongoing monitoring, check PhishDestroy’s database using the unique seed identifier 4843fd. Early incident response can prevent unauthorized fund transfers and identity theft.