trezrio-walets[.]pages[.]dev

This domain, trezrio-walets.pages.dev, was observed on July 24, 2026 and is classified as a credential phishing site. The domain resolves to the Cloudflare edge address 172.66.44.141, which belongs to AS13335 Cloudflare, Inc., and is geolocated to the United States. Registration information shows the domain was created on February 21, 2026 and is hosted through Cloudflare, Inc., using the nameservers dion.ns.cloudflare.com and june.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS connection but offering no assurance of legitimacy.

The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, suggesting that the content is being blocked by Cloudflare’s protective layer. The site appears on a single security blocklist, PhishDestroy, and has been flagged by five of ninety‑three VirusTotal scanners, reinforcing the phishing classification. Additional infrastructure signals include the presence of HTTP/3, HSTS, and Cloudflare technology fingerprints. A Gridinsoft trust score of 0 out of 100 further reflects a high likelihood of malicious intent.

The domain is currently taken offline, limiting immediate exposure, but the observed indicators warrant proactive defensive actions. Defenders should add the domain and its associated IP address to network deny lists, ensure that URL filtering solutions include the PhishDestroy blocklist entry, and monitor for any future re‑registration attempts. Continuous observation of Cloudflare‑hosted subdomains with similar naming patterns is recommended, as attackers frequently leverage the same infrastructure for rapid campaign turnover.