hub-trezr-login[.]pages[.]dev

Analysis of hub-trezr-login.pages.dev indicates a credential-phishing domain that has been taken offline as of July 24, 2026. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.66.44.161, associated with AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate was issued by Google Trust Services (WE1), and the domain was configured with HSTS, Cloudflare infrastructure, and HTTP/3 support. At the time of assessment, the domain returned an HTTP 403 status, with the page title explicitly stating 'Suspected phishing site | Cloudflare,' a label applied by the hosting provider. Infrastructure checks reveal the domain appeared on at least one security blocklist, and it was flagged by 15 of 93 security vendors in a VirusTotal scan.

Trust scores from Scamadviser and Gridinsoft both rated the domain at 1/100 and 0/100, respectively, further supporting its classification as malicious. The domain was also blocked by PhishDestroy. Nameservers were hosted under Cloudflare (matteo.ns.cloudflare.com and mina.ns.cloudflare.com). No specific brand impersonation or phishing kit details were identified in the available data, though the scam type was confirmed as credential phishing.

Defenders should treat this domain as confirmed malicious infrastructure. While the site is currently offline, organizations should monitor for re-activation or re-registration under similar naming conventions. Network-level blocks at the IP and domain level are recommended, along with alerting users who may have interacted with the domain prior to its takedown. Further investigation into associated campaigns or linked infrastructure may be warranted if additional indicators emerge.