log-en-trezarr[.]pages[.]dev

Analysis of the domain log-en-trezarr.pages.dev indicates it was actively involved in credential phishing operations before being taken offline on or before July 23, 2026. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to IP address 172.66.47.200, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers were wilson.ns.cloudflare.com and bella.ns.cloudflare.com, consistent with Cloudflare's hosting model. The SSL certificate, issued by Google Trust Services (WE1), does not provide additional attribution beyond the hosting provider.

At the time of assessment, the domain returned an HTTP 403 status, and the page title was 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated detection or manual intervention flagged the content. Gridinsoft assigned a trust score of 0/100, while Scamadviser mirrored this assessment with a 1/100 score, reinforcing the domain's malicious classification. The domain appeared on one security blocklist, and 14 out of 93 security vendors on VirusTotal flagged it as malicious, though the specific detection rules or signatures were not disclosed. No brand impersonation was explicitly identified in the available data, and the exact content or phishing kit used remains unconfirmed.

The scam type was classified as credential phishing based on external threat intelligence. Defenders should treat this domain as a confirmed malicious indicator and block it at the network and endpoint levels. Logs should be reviewed for connections to 172.66.47.200 or the domain itself, particularly from February 21, 2026, onward. Given the domain's current offline status, no active threat is present, but historical exposure should be investigated.