doc--trezr-start[.]pages[.]dev

Analysis of doc--trezr-start.pages.dev as of July 24, 2026 indicates the domain is actively associated with credential phishing activity. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the nameservers lakas.ns.cloudflare.com and brenda.ns.cloudflare.com. DNS resolution points to the IP address 172.66.47.73, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site served an HTTP 403 response and the page title returned by the server reads "Suspected phishing site | Cloudflare," confirming that Cloudflare has flagged the host as a phishing placeholder.

The TLS certificate presented is issued by Google Trust Services under the WE1 root, and the connection employs HSTS and HTTP/3, indicating a modern, encrypted delivery stack. Security telemetry shows the domain appears on one security blocklist and has a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans reported ten of ninety-three antivirus vendors flagging the domain, providing independent corroboration of its malicious nature. The domain is currently taken offline and has been blocked by the PhishDestroy sinkhole, which further confirms that active mitigation measures are in place.

While the exact phishing landing page content has not been publicly captured, the combination of a credential phishing classification, the Cloudflare "suspected phishing" page title, multiple vendor detections, and a zero trust score collectively constitute strong evidence that the domain was being used to harvest user credentials. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any attempts to resolve the domain despite its offline status, and ensure that endpoint protection solutions are updated with the latest indicators of compromise from the VirusTotal findings. Threat hunting activities should also query recent logs for HTTP requests to the 172.66.47.