en-us-trezo-help[.]pages[.]dev

PhishDestroy identifies the domain en-us-trezo-help.pages.dev as an active credential theft page operating under the guise of a support portal. The threat is classified as credential theft, with infrastructure designed to harvest user login details under false pretenses. Current status remains under investigation, but the domain is flagged as active and poses an immediate risk to visitors.

This domain was flagged by 11 of 95 VirusTotal vendors at the time of analysis, indicating it has evaded detection despite its malicious intent. It resolves to IP 188.114.97.3, is registered through Cloudflare, Inc., and holds an SSL certificate issued by Google Trust Services. No additional blocklist counts or creation date were provided in the available intelligence, though the absence of detections suggests a relatively new or stealthily configured operation.

Until further evidence emerges, PhishDestroy recommends treating en-us-trezo-help.pages.dev as a high-risk domain. Avoid visiting, clicking any links, or entering credentials. If you’ve already interacted, change passwords immediately and scan for unauthorized transactions, particularly in crypto wallets. Report the domain to your security team or through PhishDestroy’s submission portal for ongoing monitoring.