trezuur-login[.]pages[.]dev

PhishDestroy identifies trezuur-login.pages.dev as an active credential theft domain leveraging brand impersonation to harvest user credentials. The domain is currently operational and poses an elevated risk to unsuspecting users. This investigation confirms the threat actor's use of deceptive login pages to capture sensitive authentication data, which may lead to unauthorized access and financial loss.

This domain was flagged by 9 of 95 VirusTotal security vendors, indicating widespread suspicion among threat intelligence platforms. The domain is registered through Cloudflare, Inc., resolves to IP address 188.114.97.3, and holds a Google Trust Services SSL certificate, which may enhance its perceived legitimacy. Additional technical indicators include its deployment on Cloudflare Pages, a platform often abused for phishing due to its free hosting and rapid deployment capabilities. The domain's recent creation and low trust scores further suggest malicious intent, with no established reputation in legitimate ecosystems.

The domain remains active and should be treated as a high-risk threat. Immediate action is required to block trezuur-login.pages.dev at the network perimeter, email gateways, and endpoint security solutions. Users should be warned against interacting with this domain and any associated login prompts. Organizations are advised to update blocklists, monitor for credential leaks, and conduct security awareness training to mitigate the risk of credential theft. Further, investigate any potential compromise of credentials submitted to this domain to prevent downstream attacks.