en-trzrsuite-app-doo[.]pages[.]dev

PhishDestroy identifies en-trzrsuite-app-doo.pages.dev as a live phishing domain masquerading as a legitimate Suite application portal. Security researchers observe this domain leveraging Cloudflare Pages infrastructure to host spoofed login interfaces, tricking users into surrendering credentials under the guise of routine software updates. The threat actor’s infrastructure points to 172.66.44.229, with SSL secured by Google Trust Services—an increasingly common tactic to bypass browser warnings and enhance phishing realism. This domain was flagged by PhishDestroy after registering 0 detections on VirusTotal against 95 engines, indicating a fresh campaign still under the radar. Registered via Cloudflare, Inc., the domain operates through Cloudflare Pages, allowing rapid deployment and takedown evasion. Despite a clean VirusTotal score at this time, the absence of public blocklists does not equate to safety—this reflects only the current snapshot in threat intelligence feeds. If you visited en-trzrsuite-app-doo.pages.dev, cease use immediately, disconnect from the network, and inspect any entered credentials for compromise. Revoke session tokens and passwords tied to this interaction, and enable multi-factor authentication across all accounts. Report the domain to your security team or via PhishDestroy’s public portal to help block further propagation and protect others from this evolving threat.