troz-io[.]pages[.]dev

Security teams have flagged the domain troz-io.pages.dev as an active phishing site impersonating AI-powered login interfaces. This domain, hosted on Cloudflare Pages (172.66.47.54), deploys HTTPS credentials via Google Trust Services to appear legitimate, tricking users into surrendering authentication tokens under the guise of an AI service login workflow. The template closely mirrors high-profile consumer AI platforms, leveraging dynamic subdomains to evade detection while harvesting credentials in real time.

Analysis of troz-io.pages.dev confirms it poses a moderate-to-high risk based on current telemetry. The domain registered via Cloudflare, Inc. exhibits zero detections across 95 VirusTotal engines, suggesting a minimal footprint on automated scanning databases. Despite zero blocklist hits, the active SSL certificate (Google Trust Services) and resolved IP (172.66.47.54) are consistent with domains frequently repurposed for credential harvesting campaigns. While creation details remain obscured by Cloudflare’s privacy protections, the lack of signature coverage indicates this vector may be newly deployed or purposefully obfuscated to bypass legacy detection rules.

If you accessed troz-io.pages.dev or entered any credentials, immediately rotate passwords for affected services and enable multi-factor authentication. Scan endpoints for unauthorized data exfiltration or persistence mechanisms, particularly in browser profiles or saved sessions. Report the domain to your security operations team and block the IP 172.66.47.54 at the network perimeter. Monitor for anomalous login attempts or AI service-related alerts within your environment.