hub-logen-treezio[.]pages[.]dev

PhishDestroy identifies hub-logen-treezio.pages.dev as an active credential harvesting phishing site hosted on Cloudflare Workers. This domain resolves to IP 172.66.47.164 and operates behind Google Trust Services SSL, increasing its credibility. The page was flagged under seed 115fa5 and is currently under investigation by security teams. No detections on VirusTotal as of the latest scan suggests this phishing campaign is either newly deployed or employs highly evasive techniques to evade automated detection engines.

This domain was flagged as a credential harvesting phishing site due to its likely role in mimicking legitimate login portals to trick users into submitting sensitive information. The site’s infrastructure (Cloudflare Workers, Google SSL) allows rapid deployment and rotation, making traditional blocklists ineffective. VirusTotal’s 3/95 detection ratio at the time of evaluation indicates the absence of signatures in leading security engines, highlighting the need for behavioral and heuristic analysis rather than relying on file-based detection alone. Threat actors often use Cloudflare Pages or Workers to host phishing pages because of the service’s legitimate appearance and speed, making it harder for users to distinguish between real and fake pages.

Users who visited hub-logen-treezio.pages.dev should immediately check their accounts for unauthorized access. If any login credentials were entered on this site, change passwords immediately and enable multi-factor authentication on all related accounts. Clear browser cache and cookies for this domain and monitor accounts for suspicious activity such as unexpected transactions or data exfiltration. Report the domain to your security provider or browser vendor to aid in blocking efforts. Avoid reusing passwords across sites, as compromised credentials may be used in broader account takeovers.