home-trzur-io-2or[.]pages[.]dev

PhishDestroy identifies home-trzur-io-2or.pages.dev as an active credential theft phishing domain weaponizing the Cloudflare Pages service to host fake login portals. The site masquerades as a legitimate service to harvest user credentials, aligning with generic phishing tactics observed across similar domains. No specific brand or drainer kit has been tied to this domain within current threat intelligence feeds.

This domain resolves to IP 172.66.44.147 and was registered through Cloudflare, Inc. using Google Trust Services for its SSL certificate. Threat analysis reveals a low detection rate, with only 2 out of 95 VirusTotal security vendors flagging this domain as malicious as of the latest scan. The domain’s recent deployment and minimal blocklist presence indicate an emerging but active threat vector targeting unsuspecting users.

As of this report, home-trzur-io-2or.pages.dev remains active and categorized as an elevated-risk domain. Security teams and end-users should immediately block this domain at the network and endpoint levels. Users who may have interacted with this site are advised to rotate passwords and enable multi-factor authentication on compromised accounts. While the immediate risk can be mitigated through proactive blocking, the domain’s low initial detection score suggests potential for continued evasion, warranting heightened monitoring and user awareness.