trezer-bridge-io-public-us[.]pages[.]dev

Analysis of trezer-bridge-io-public-us.pages.dev indicates that the domain is actively being used for a generic phishing campaign. The site was registered on June 10, 2026 through Cloudflare Pages, a service that provides static site hosting and automatically provisions SSL certificates. Shortly after registration, the domain appeared on a security blocklist and was subsequently blocked by the PhishDestroy sinkhole, confirming malicious intent.

VirusTotal scans reveal that 10 of 91 security vendors have flagged the domain as malicious, reinforcing the suspicion raised by the blocklist entry. The domain’s risk level is cataloged as elevated, and its operational status is listed as active, suggesting that threat actors may still be exploiting it to harvest credentials or distribute further payloads. Defenders should add trezer-bridge-io-public-us.pages.dev to local blocklists, enforce DNS filtering, and monitor outbound traffic for connections to the Cloudflare Pages network that resolve to this hostname.

Given the limited detection coverage—only a fraction of vendors have raised alerts—continuous re‑scanning is advised to capture any changes in the site’s behavior. Organizations should also review endpoint logs for any user‑initiated requests to the domain, especially from browsers or email clients, and consider isolating affected machines pending investigation. The evidence base consists of the registration timestamp, blocklist presence, PhishDestroy block, and the 10/91 VirusTotal detection count; no additional intelligence such as page title or target brand is currently available, so further profiling of the site’s content remains pending.