en-us-bridgetrezr[.]pages[.]dev

PhishDestroy identifies en-us-bridgetrezr.pages.dev as an active credential theft phishing domain leveraging a generic template designed to harvest user credentials under false pretenses. The infrastructure impersonates a legitimate service, likely targeting unsuspecting users with deceptive login prompts. No evidence of a crypto-draining kit or advanced obfuscation was observed during initial triage, suggesting a straightforward but effective campaign. This domain resolves to IP 172.66.44.111 and is registered through Cloudflare, Inc., utilizing a Google Trust Services SSL certificate for added legitimacy. VirusTotal analysis returned 7/95 detections at the time of assessment, indicating the domain remains under the radar. The page employs a Pages.dev subdomain, a tactic often used to bypass traditional email filtering mechanisms. Creation date and additional metadata are pending further OSINT correlation, but the absence of detections and reliance on a reputable CDN provider underscore the stealthy nature of this threat. Currently, en-us-bridgetrezr.pages.dev remains active and unblocked by major threat intelligence platforms. Immediate containment measures, including DNS sinkholing and network-level blocking, are recommended to mitigate potential credential harvesting. While the risk is classified as under_investigation due to limited telemetry, the domain’s use of a trusted certificate and low detection rate elevates its potential impact. SOC teams should prioritize monitoring for associated IOCs and update blocklists to prevent further compromise. Remaining risk is moderate but could escalate if the campaign gains traction or pivots to more sophisticated techniques.