us-tregor-suite[.]pages[.]dev

PhishDestroy identifies us-tregor-suite.pages.dev as an ACTIVE Microsoft 365 credential phishing domain under investigation, posing a high-risk threat to users expecting legitimate productivity suite access.

This domain was flagged for Microsoft 365 phishing with critical technical indicators: SSL certificate issued by Google Trust Services, resolving to IP 172.66.45.4, zero detections on VirusTotal (9/95 engines), Cloudflare registration, and active page hosting on Pages.dev. The domain exhibits advanced evasion tactics by leveraging legitimate cloud infrastructure to bypass traditional security measures.

Risk assessment reveals this Microsoft 365 phishing campaign employs sophisticated techniques: the Google-issued SSL certificate creates false trust signals, while Cloudflare's infrastructure enables rapid domain cycling. The absence of VirusTotal detections (9/95) suggests either extreme recency or highly targeted attacks bypassing standard detection. Users interacting with this domain risk credential theft through fake login portals mimicking Microsoft 365 interfaces. The active status on Pages.dev indicates ongoing operations despite zero current detections.

Immediate mitigation requires blocking both the domain and IP address at network levels, as this phishing kit specifically targets Microsoft 365 authentication flows. Users should verify all email links through official Microsoft channels before clicking, implement multi-factor authentication to mitigate credential reuse, and report suspicious activity to Microsoft's security response team. Organizations must update endpoint protection rules to flag any Microsoft 365 login prompts originating from Pages.dev domains or the associated IP range.