read-access-trzrr-io[.]pages[.]dev

PhishDestroy identifies the domain read-access-trzrr-io.pages.dev as a live credential-harvesting page currently under active criminal use. According to the latest telemetry feed, the host is flagged by 2 of 95 VirusTotal vendors and remains undetected at the time of this advisory. The infrastructure points to Cloudflare Pages with a Google Trust Services TLS certificate, resolving to IP 188.114.96.3.

This domain was flagged by 2 of 95 VirusTotal vendors, registered through Cloudflare, Inc., resolves to IPv4 188.114.96.3, and operates under a Google Trust Services SSL certificate valid for *.pages.dev. The host is deployed on Cloudflare Pages, a legitimate platform abused for rapid campaign deployment and domain generation. Despite zero detections on the VirusTotal platform, the domain is currently active and under criminal control, presenting an immediate risk to users who may unwittingly submit credentials or sensitive data.

As of the latest query, the domain read-access-trzrr-io.pages.dev remains active and unblocked, posing a persistent threat to end users and organizations alike. Security teams are advised to immediately block the domain at DNS and firewall levels, isolate any endpoints that have communicated with 188.114.96.3, and scan for suspicious credential submission patterns. Additionally, users should avoid accessing the domain and report any unsolicited links or forms purporting to offer document access or login portals. Continuous monitoring and IOC enrichment are recommended to prevent further compromise.