traisser--ios--start[.]pages[.]dev

PhishDestroy identifies traisser--ios--start.pages.dev as a live phishing page impersonating Apple’s iOS login portal. The domain uses a Cloudflare Pages template (traisser--ios--start.pages.dev) hosted on IP 188.114.96.3 with a Google Trust Services SSL certificate, creating a convincing fake login form designed to harvest Apple ID credentials and session tokens. The page likely prompts victims to enter their username and password under the guise of a routine iOS update or account verification, leading to immediate account takeover or payment fraud.

This domain remains undetected by security engines, showing 0 detections out of 95 scanners on VirusTotal at the time of analysis. It is registered through Cloudflare, Inc., leveraging the platform’s legitimate infrastructure to evade traditional blocklists. The active status indicates ongoing use in campaigns, likely targeting Apple users through deceptive links in SMS, email, or social media messages. Users should treat this domain as high-risk despite its low detection score, as it exploits trusted services (Cloudflare Pages, Google SSL) to bypass security checks.

If you visited traisser--ios--start.pages.dev, assume your Apple credentials may have been exposed. Disconnect from the internet, change your Apple ID password immediately using a separate device, and enable two-factor authentication. Review recent devices and sessions in your Apple ID account to revoke any unauthorized access. Report the domain to PhishDestroy and avoid interacting with similar links in the future. Always verify unexpected login prompts by visiting appleid.apple.com directly.