traisars--io-start[.]pages[.]dev

PhishDestroy identifies traisars--io-start.pages.dev as an active credential harvesting phishing domain with an elevated risk level. The campaign leverages a Cloudflare Pages deployment to mimic a legitimate service and harvest user credentials.

This domain was flagged by VirusTotal, scoring 1 detection out of 95 security vendors. It was registered through Cloudflare, Inc. using Google Trust Services SSL certificates. The domain resolves to IP address 188.114.97.3 and is hosted on Cloudflare Pages infrastructure. Despite its recent creation, it has already begun appearing in early blocklists and maintains low trust scores due to its active malicious behavior.

To mitigate this threat, organizations should immediately block traisars--io-start.pages.dev at the network and DNS levels. Users who may have interacted with this domain should reset passwords for any credentials entered, enable multi-factor authentication where available, and scan devices for malware. Report any observed activity to your security team or relevant threat intelligence platforms and avoid accessing this domain or its subpages further.