bridge--treezoor[.]pages[.]dev

PhishDestroy identifies bridge--treezoor.pages.dev as an active phishing domain engaged in credential harvesting, currently impersonating a financial login portal. The site remains operational and is actively collecting user credentials under false pretenses. No formal takedown action has been confirmed, and the threat level remains under investigation as of seed 5a4248.

This domain was flagged by 7 of 95 VirusTotal vendors, registered through Cloudflare, Inc., resolves to IP 188.114.96.3, and utilizes a Google Trust Services SSL certificate. The page operates under Cloudflare Pages, a legitimate service often abused for phishing deployments. The lack of detections by security vendors suggests evasion techniques such as short-lived domains or dynamic DNS are in play. No additional blocklist counts or trust scores are publicly available at this time.

Users are strongly advised to avoid interacting with bridge--treezoor.pages.dev and report the domain to their security teams or via platforms like PhishDestroy. Organizations should inspect DNS logs for queries to 188.114.96.3 and monitor outbound traffic for exfiltration attempts. If credentials were entered, users must rotate passwords immediately and enable multi-factor authentication on all related accounts. Security researchers are encouraged to collect telemetry for further analysis and potential takedown requests.