suport-trezeer-suit[.]pages[.]dev

PhishDestroy identifies an active credential-harvesting domain, suport-trezeer-suit.pages.dev, currently posing as a support portal to deceive users into surrendering login credentials. This domain exhibits elevated risk due to its clear intent to mimic legitimate support infrastructure, a common tactic in targeted phishing operations. This domain was flagged by 1 out of 95 VirusTotal security vendors, indicating limited but present detection coverage. It resolves to IP 172.66.44.184, registered through Cloudflare, Inc., and leverages a Google Trust Services SSL certificate to enhance its appearance of legitimacy. Despite these superficial trust signals, the domain’s recent creation and low detection rate underscore its potential for evading conventional security measures. No blocklist entries were identified at the time of analysis, further emphasizing the need for proactive monitoring. To mitigate exposure to this threat, organizations should immediately block the domain and associated IP address at the network perimeter. Users should be warned against interacting with unsolicited support links and encouraged to verify the legitimacy of any support requests through official channels. Security teams are advised to monitor for similar domains leveraging Cloudflare Pages or Google Trust Services certificates, as these may indicate coordinated phishing campaigns.