trozor-sutite[.]pages[.]dev

PhishDestroy identifies trozor-sutite.pages.dev as an active credential-harvesting phishing domain under investigation. This domain poses a significant risk to users by impersonating legitimate services to steal login credentials and sensitive data. The infrastructure leverages Cloudflare’s Pages service, which provides evasion opportunities via dynamic hosting and legitimate-looking SSL certificates issued by Google Trust Services. Resolving to IP 188.114.96.3, the domain has not yet triggered detection mechanisms, with VirusTotal showing 1 out of 95 engines currently flagging it. The threat posed by trozor-sutite.pages.dev is particularly insidious due to its use of Cloudflare Pages, a legitimate platform that can be abused for rapid domain cycling and evasion of traditional blocklists. The domain’s registration through Cloudflare, Inc., combined with the absence of detections on VirusTotal, highlights its potential for bypassing initial security checks. While the exact creation date remains unverified, the lack of blocklist coverage—currently 0 detections—suggests it is a recent or opportunistic campaign. The SSL certificate issued by Google Trust Services further lends credibility to phishing lures, potentially tricking users into interacting with malicious content under the guise of legitimacy. Users who have interacted with trozor-sutite.pages.dev should immediately change passwords for any credentials entered on the site and enable multi-factor authentication where possible. Avoid accessing the domain further, and report the activity to your security team or through your organization’s phishing reporting channels. If credentials were exposed, monitor accounts for suspicious activity and consider revoking any sessions tied to the affected credentials. Organizations should block the domain at the network level and update firewall rules to include the IP 188.114.96.3, while investigating for lateral movement within the environment.