connect-trzr-wlt[.]pages[.]dev

Analysis of the domain connect-trzr-wlt.pages.dev indicates active malicious use targeting credential collection. The domain was created on October 15, 2025 and is hosted on Cloudflare Pages, resolving to the IP address 172.66.44.149. VirusTotal records show that 12 out of 91 security vendors have flagged the domain as malicious, confirming a consensus of detection across multiple scanning engines.

The domain is currently blocked by the PhishDestroy service and appears on one external security blocklist, reinforcing its classification as a phishing vector. No additional information such as page title, SSL certificate details, Safe Browsing status, or further threat‑intel identifiers (e.g., OTX tags) is presently available, leaving those aspects unverified. Defenders should prioritize immediate containment by adding the domain and its resolved IP to network deny lists and web filtering rules.

Continuous monitoring of Cloudflare Pages infrastructure for new subdomains associated with the same IP is recommended, as well as periodic re‑query of VirusTotal and other reputation services for any changes in detection counts. Given the elevated risk rating and active status, proactive blocking and alerting on any authentication attempts to this host are advised.