connect--trzor-doc[.]pages[.]dev

Analysis of the domain connect--trzor-doc.pages.dev indicates that it was actively used for credential phishing before being taken offline. The domain resolves to 172.66.45.2, which is owned by AS13335 Cloudflare, Inc. and located in the United States. Cloudflare is also the registrar, and the domain was created on 21 February 2026. The authoritative nameservers are audrey.ns.cloudflare.com and armando.ns.cloudflare.com, confirming Cloudflare hosting. The site served an HTTP 403 response and advertised HSTS and HTTP/3 support, with an SSL certificate issued by Google Trust Services (WE1). VirusTotal scans show that six of ninety‑three security vendors flagged the domain, and it appears on a single blocklist, where it was blocked by PhishDestroy.

The Gridinsoft trust score of 0/100 further indicates a high‑risk rating. The page title returned by the server is “Suspected phishing site | Cloudflare,” which aligns with the generic phishing classification. Six security vendors on VirusTotal flagged the domain, indicating that multiple independent scanners identified malicious characteristics. The single blocklist entry, identified by PhishDestroy, demonstrates that at least one commercial threat intelligence feed has already categorized the host as malicious. The presence of HSTS and HTTP/3 suggests that the operator configured modern security headers, possibly to mimic legitimate services and evade simple heuristics. The SSL certificate chain, issued by Google Trust Services, is commonly used by legitimate Cloudflare‑protected sites, which can further obscure the malicious nature of the host.

The 403 HTTP status code may have been employed to prevent casual browsing while still allowing scripted credential harvesting. The domain’s short lifespan—created less than five months before the report date—combined with a zero‑score trust rating from Gridinsoft, points to a purpose‑built phishing infrastructure rather than an abandoned or compromised legitimate site.