io-eng-trezo-start[.]pages[.]dev

Analysis of the domain io-eng-trezo-start.pages.dev indicates it was operational as a credential phishing site prior to being taken offline. The domain, registered through Cloudflare on February 21, 2026, resolved to the IP address 172.66.47.99, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers michelle.ns.cloudflare.com and quentin.ns.cloudflare.com were in use, consistent with Cloudflare's hosting model. The domain was flagged by 11 of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist, including PhishDestroy. Gridinsoft assigned a trust score of 0/100, further supporting its classification as malicious.

The page title, 'Suspected phishing site | Cloudflare,' and HTTP 403 status suggest Cloudflare's automated systems may have detected and restricted access to the domain. Technologies detected include HSTS, Cloudflare's CDN, and HTTP/3, which are common in both legitimate and malicious hosted content. The SSL certificate, issued by Google Trust Services (WE1), provides no additional indicators of compromise beyond standard encryption practices. While the domain is categorized as credential phishing, the exact target or brand impersonated is not specified in available data.

No evidence of a specific phishing kit or additional infrastructure links has been identified. Defenders should treat this domain as confirmed malicious for credential harvesting purposes. Monitoring for re-activation or related domains under Cloudflare Pages or similar hosting services is recommended, particularly those registered around the same date or sharing naming conventions. If historical or cached content becomes available, further analysis of the phishing mechanism may be possible.