tersor-seo-suite[.]pages[.]dev

Analysis of tersor-seo-suite.pages.dev as of 29 July 2026 shows that the domain is currently active and associated with a generic phishing campaign. The domain resolves to the IP address 172.66.44.241, which is hosted by Cloudflare, Inc. The authoritative name servers are cesar.ns.cloudflare.com and marissa.ns.cloudflare.com, indicating that the domain leverages Cloudflare’s DNS infrastructure. Registration data also lists Cloudflare as the registrar, a pattern commonly observed for disposable or short‑lived phishing infrastructure. Threat intelligence aggregators have flagged the domain.

VirusTotal reports that 11 of 91 scanned security vendors label the domain as malicious, providing a moderate consensus of detection across independent engines. Additionally, the domain appears on one external blocklist and is listed as blocked by PhishDestroy, further corroborating its malicious use. No other public reputation services or safe‑browsing checks are cited in the supplied intelligence. The available evidence does not include a TLS certificate fingerprint, HTTP status code, page title, or any observed landing‑page content, so the exact visual or functional characteristics of the phishing page remain unknown.

Consequently, defenders cannot confirm which brand or credential collection technique is employed, nor can they assess the presence of additional payloads such as malware drop‑offs. Given the confirmed hosting, DNS, and detection signals, security teams should treat any traffic to tersor‑seo‑suite.pages.dev as hostile. Recommended actions include adding the domain and its IP address to local deny lists, configuring network firewalls or proxy filters to block outbound connections, and updating endpoint protection signatures to incorporate the 11 vendor detections. Continuous monitoring of the IP address for any changes in reputation and periodic re‑scanning of the domain with sandbox services are advised to capture potential evolution of the threat.