us-en-trozr[.]pages[.]dev

Analysis of the domain us-en-trozr.pages.dev shows multiple indicators of malicious activity consistent with credential phishing. The domain was registered on February 21, 2026 through Cloudflare, Inc., and resolves to the IP address 172.66.47.170, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a Cloudflare‑generated page titled "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, suggesting that the content has been taken offline but that the domain remains under active monitoring. Security‑vendor scans on VirusTotal recorded six detections out of ninety‑three scanners, reinforcing the suspicion of abuse.

Independent blocklists have flagged the domain, with PhishDestroy explicitly listing it as blocked and a single additional security blocklist also referencing it. The SSL certificate presented is issued by Google Trust Services under the WE1 designation, a standard Cloudflare‑managed certificate, which does not provide any mitigation against the underlying phishing intent. Reputation scoring from Gridinsoft rates the domain at 0 out of 100, indicating an extremely low trust level. Infrastructure analysis reveals the use of HSTS, Cloudflare’s edge network, and HTTP/3, all typical of legitimate services but also commonly leveraged by threat actors to hide malicious payloads behind trusted infrastructure.

The nameservers lilith.ns.cloudflare.com and nick.ns.cloudflare.com further confirm reliance on Cloudflare’s DNS services. While the exact phishing landing page content cannot be observed because the site is offline, the combination of recent registration, low trust score, vendor detections, and blocklist entries provides strong evidence that the domain was employed for credential phishing. Defenders should continue to block the domain at perimeter defenses, monitor for any resurgence of activity, and add the IP address 172.66.47.170 to threat‑intel feeds.