trejr-io-start[.]pages[.]dev

PhishDestroy identifies an active credential-harvesting campaign hosted at trejr-io-start.pages.dev that mimics a Microsoft login portal in order to capture user email addresses and passwords. The domain is deployed on Cloudflare Pages and resolves to IP 172.66.47.3, making it appear legitimate to casual visitors. Attackers use the familiar Microsoft login UI to trick victims into surrendering their credentials, which are then relayed to attacker-controlled servers for abuse. This domain was flagged by PhishDestroy on seed e9dae5; VirusTotal currently shows 0 out of 95 engines detecting the threat, and the site is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, adding to its deceptive appearance. The campaign remains active and continues to harvest credentials from unsuspecting users who believe they are signing into a Microsoft service. If you visited trejr-io-start.pages.dev and entered any credentials, immediately change your Microsoft account password using a known-good device. Enable multi-factor authentication on your Microsoft account and scan your device for malware. Report the incident to your IT team or Microsoft Security if this was a work account. Avoid reusing the exposed password on other services. Monitor your Microsoft account for any unusual login attempts or unauthorized changes.