trz-en-suit--io[.]pages[.]dev

PhishDestroy identifies trz-en-suit--io.pages.dev as a live Microsoft 365 credential phishing domain currently under investigation and actively distributing phishing lures.

This domain is registered through Cloudflare, Inc., resolves to IP 172.66.47.49, and uses a Google Trust Services SSL certificate. VirusTotal scanning engines currently report 0 detections out of 95, indicating that mainstream antivirus or URL-blocking services have not yet flagged this page as malicious. No independent threat intelligence feeds list the domain, and WHOIS data does not reveal a public creation date. The landing page mimics Microsoft 365 login flows, likely attempting to harvest enterprise credentials under the guise of account verification or security alerts.

Mitigation steps for Microsoft 365 credential phishing include enabling multi-factor authentication (MFA) on all Microsoft 365 accounts, training users to inspect domain URLs before entering credentials, and deploying advanced email filtering rules to quarantine messages with suspicious login prompts. Organizations should also monitor for anomalous authentication attempts and disable legacy authentication protocols to reduce exposure to this class of attack.