started-treezor[.]netlify[.]app

This domain, started-treezor.netlify.app, is identified as a high-risk credential theft operation targeting users of Treezor, a European payment services provider. Analysis indicates the site employs a fraudulent login interface to harvest user credentials, likely for subsequent unauthorized account access or financial fraud. The domain mimics legitimate Treezor branding, including logos and page layout, to deceive victims into disclosing sensitive authentication details. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to the IP address 35.157.26.135. The SSL certificate is issued by DigiCert Inc, providing a false sense of security to visitors. As of the latest assessment, the domain remains active and has been flagged by 9 out of 95 security vendors on VirusTotal. No creation date is publicly available due to Netlify’s hosting model, which does not expose traditional WHOIS records. Google Safe Browsing (GSB) has not yet listed the domain, and no additional blocklist entries were identified beyond the VirusTotal detections. The domain’s current status remains active, with no evidence of takedown or mitigation efforts. The use of a reputable hosting provider and valid SSL certificate increases the likelihood of successful deception, particularly among users unfamiliar with phishing tactics. Organizations and individuals are advised to block access to this domain at the network level and implement multi-factor authentication (MFA) to mitigate credential theft risks. Users who may have interacted with the site should immediately reset their credentials and monitor accounts for unauthorized activity. Continued vigilance is recommended, as similar domains may emerge using comparable impersonation tactics.