us-suitrezo-help[.]pages[.]dev

PhishDestroy categorizes us-suitrezo-help.pages.dev under a generic_phishing threat profile, indicating it is deployed for broad-based fraud campaigns rather than targeting a single high-value brand. The domain leverages Cloudflare Pages and Google Trust Services to lend an air of legitimacy, while the underlying infrastructure (IP 172.66.47.110) is managed by Cloudflare, Inc. Given the absence of a specific drainer kit signature, this site likely functions as a credential-harvesting or payment-data collection portal, typical of “support scam” lures that redirect victims from fake help-desk pages or social media spam.

This domain was flagged with a current VirusTotal detection ratio of 3/95 engines, meaning no antivirus or browser-blocklist services have yet recognized its malicious payload or hosting pattern. It is registered through Cloudflare, Inc., resolves to IP 172.66.47.110, and is secured with a Google Trust Services SSL certificate. The seed identifier 76120e was generated at the time of ingestion, and the page remains active as of the latest scan. Because the IP is part of Cloudflare’s shared CDN range, traditional IP-based blocking is less effective, necessitating domain-level intervention.

The current status is active, and the threat level is under_investigation while analysts continue to profile the campaign and extract IOCs. Security teams are advised to block the domain at DNS and firewall layers, and to monitor for newly spawned subdomains or sibling domains sharing the same Pages.dev origin. Remaining risk is moderate owing to the unflagged status and shared-hosting evasion techniques, but should decline rapidly once detection signatures propagate through threat-intel feeds. Users who encounter this page should report it to their security vendor and avoid entering any data.