bridge-trazor-en-io-es[.]pages[.]dev

PhishDestroy identifies bridge-trazor-en-io-es.pages.dev as an active generic phishing domain under investigation for mimicking legitimate Razor services and harvesting user credentials. This site poses a direct threat to individuals and organizations relying on Razor infrastructure and should be treated as a high-risk impersonation campaign. Users who encounter this domain are advised to abstain from interaction and report the incident to their security teams.

This domain was flagged by PhishDestroy’s seed 49f76e and resolves to IP 172.66.47.50, registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, indicating a measure of legitimacy that is commonly exploited by adversaries to evade detection. VirusTotal currently shows 12/95 detections, meaning traditional antivirus engines have not yet flagged this domain, highlighting the need for behavioral analysis and threat intelligence correlation. No entries were found on major blocklists at the time of writing, underscoring the evasive nature of the campaign.

To mitigate exposure, users must refrain from accessing bridge-trazor-en-io-es.pages.dev or any subpages linked from it. Organizations should implement DNS filtering to block resolution to 172.66.47.50 and inspect outbound traffic for connections to this IP or domain. Security teams are advised to search email logs for delivery attempts leveraging subjects or sender addresses mimicking Razor support. If exposure is suspected, users should rotate credentials immediately and enable multi-factor authentication on all associated accounts. Reporting to PhishDestroy via seed 49f76e will expedite takedown and reduce risk of propagation.