tersor-w-suite[.]pages[.]dev

On 29 July 2026 the domain tersor-w-suite.pages.dev was identified as an active phishing infrastructure with an elevated risk rating. VirusTotal records show that 11 of 91 scanned security vendors flagged the domain, indicating a moderate level of detection across the threat‑intelligence community. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. Technical resolution points to the IP address 188.114.96.3, which is hosted by Cloudflare, Inc. The domain’s authoritative nameservers are gerald.ns.cloudflare.com and malavika.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure.

Registration details confirm that the domain was provisioned through Cloudflare, a common choice for fast‑deployment of malicious sites because of its ubiquitous CDN and privacy‑preserving features. Current intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed brand impersonation, leaving the exact content of the site unverified. Likewise, there is no publicly available information on additional hosting attributes such as ASN or geographic location beyond the IP address. Consequently, the precise phishing lure and victim profile remain unknown.

Defenders should prioritize immediate blocking of tersor-w-suite.pages.dev at perimeter and DNS filtering layers, as well as adding the associated IP 188.114.96.3 to network‑level deny lists. Continuous monitoring of Cloudflare‑hosted domains that resolve to the same IP is advised, given the platform’s frequent reuse in malicious campaigns. Where possible, threat‑intel platforms should ingest the VirusTotal detection count and blocklist indicator to enrich existing rule sets. Ongoing investigation should aim to retrieve the site’s HTTP payload, capture any credential‑harvesting forms, and correlate traffic with known phishing kits to refine attribution.