trzrr-io-en[.]pages[.]dev

The domain trzrr-io-en.pages.dev is currently flagged as a phishing site under investigation. Infrastructure analysis shows the domain is hosted on Cloudflare’s edge network, resolving to the IPv4 address 172.66.44.199. The authoritative name servers are dee.ns.cloudflare.com and uriah.ns.cloudflare.com, consistent with a Cloudflare‑registered tenant. Registration data confirms the domain was provisioned through Cloudflare, Inc., indicating the attacker leveraged a reputable registrar to obtain a short‑lived, inexpensive sub‑domain under the pages.dev suffix.

The domain appears on at least one external security blocklist and has been explicitly blocked by PhishDestroy, providing independent confirmation of malicious intent. VirusTotal has processed the domain through 91 antivirus and URL scanning engines; none of the engines have raised a detection at the time of analysis, but the absence of a flag does not constitute evidence of benign behavior. No Safe Browsing or Open Threat Exchange records are presently associated with the domain, and no SSL certificate details, HTTP response codes, or page‑title metadata have been disclosed in the available intelligence.

Consequently, the exact content and target of the phishing campaign remain unknown, and further dynamic analysis is required to identify the credential‑ harvesting techniques employed. Defenders should continue to enforce DNS‑level filtering for the domain, incorporate the observed blocklist entries into local mitigation policies, and monitor Cloudflare’s edge IP ranges for related activity. Ongoing vigilance is advised, including periodic rescanning with threat‑intelligence platforms to capture any future detections that may emerge as the campaign evolves.