en-io-trezo-dev[.]pages[.]dev

Analysis of en-io-trezo-dev.pages.dev shows a newly registered domain (created 21 February 2026) that is currently offline but was previously flagged as a credential phishing site. The page title returned by the server is “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s automated protection identified malicious activity. The domain resolves to 172.66.44.149, an IP address owned by AS13335 Cloudflare, Inc. in the United States, and uses Cloudflare‑provided DNS with nameservers grace.ns.cloudflare.com and kyle.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming a valid SSL chain but offering no assurance about the underlying content.

HTTP responses return a 403 status, consistent with Cloudflare’s block page. Security profiling shows the site appears on one external blocklist and is listed by PhishDestroy as a malicious phishing host. VirusTotal analysis recorded 11 of 93 scanners flagging the domain, corroborating the suspicion. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, indicating a highly untrusted rating.

The registrar information confirms the domain is registered through Cloudflare, Inc., a common choice for abuse due to rapid provisioning. While the exact phishing landing page has not been captured, the combination of credential phishing classification, blocklist presence, multiple vendor detections, and Cloudflare’s own warning page provides strong evidence of malicious intent. Defenders should add the domain to network and DNS blocklists, monitor for any future re‑activation, and consider correlating inbound traffic logs for the associated IP address. Continuous re‑scanning is advised in case the site becomes active again, and any related malicious payloads should be examined for attribution.