welcome-trzorcomstrt[.]pages[.]dev

The domain welcome-trzorcomstrt.pages.dev has been identified as an active threat hosting a credential phishing scheme aimed at harvesting user login information. The phishing campaign appears to leverage a drainer kit designed to steal sensitive credentials by mimicking legitimate login portals, though no specific brand impersonation is confirmed from the available data.

Technical indicators show that VirusTotal rates this domain with a low detection score of 1 out of 95 security vendors flagging it. The domain is registered through Cloudflare, Inc., and resolves to IP address 172.66.44.136. It uses an SSL certificate issued by Google Trust Services, which may lend a false sense of security to victims. The domain’s creation date is not specified here, but its Google Safe Browsing (GSB) status is active, indicating a recognized threat presence. There is a single blocklist hit reported, reinforcing its elevated risk level.

Currently, welcome-trzorcomstrt.pages.dev remains active and accessible, posing a continued risk to users who may encounter it. It is not widely detected by antivirus engines yet, which increases the potential for successful exploitation. Security teams should monitor and block this domain proactively, while users should avoid interacting with unsolicited links or login prompts originating from this site. Enhanced vigilance and timely threat intelligence updates are advised to mitigate credential theft risks associated with this domain.