faq-login-trezr-io-us[.]pages[.]dev

Analysis indicates that the domain faq-login-trezr-io-us.pages.dev was registered on June 10 2026 through Cloudflare Pages, a service that provides static site hosting and DNS management. The domain is currently listed as active with an elevated risk rating. It has been added to at least one security blocklist and is flagged by PhishDestroy, confirming that it is being used for malicious credential collection.

VirusTotal scans show that 12 of 91 security vendors have flagged the domain, a signal that multiple independent engines have observed suspicious behavior. The limited blocklist presence suggests that the domain is relatively new and may not yet be widely propagated across all threat feeds. No additional public intelligence such as Safe Browsing alerts, OTX entries, or SSL reputation data is available in the current dataset.

Consequently, the full scope of the phishing campaign, including targeted brands or the specific login page content, remains unknown. Defenders should proactively block the domain at the DNS or proxy level, monitor for outbound connections to the associated IP ranges used by Cloudflare Pages, and update intrusion detection signatures to include the observed domain pattern. Continuous re‑evaluation is advised as further telemetry, such as additional vendor detections or blocklist listings, may emerge.