tresr-io-sart-info[.]pages[.]dev

On 2026-08-07 the analyst team assigned seed 2a041c evaluated the domain tresr-io-sart-info.pages.dev, which is currently classified as a generic phishing infrastructure with an elevated risk rating. The domain is actively resolving to the IPv4 address 172.66.47.109. Reputation services PhishDestroy and OpenPhish have both listed the domain as blocked, indicating that it is recognized by multiple anti‑phishing feeds. VirusTotal has processed the host and 17 out of 91 security vendors returned a positive detection for malicious activity, reinforcing the suspicion that the site is being used for credential harvesting or other fraudulent purposes.

In addition, two independent security blocklists contain the domain, further confirming its presence on threat intel aggregators. The available data do not reveal the underlying web server response codes, TLS certificate details, or the exact page title presented to visitors, so those aspects remain unverified. Likewise, no attribution to a specific phishing kit or actor has been disclosed. The lack of publicly available hosting metadata beyond the resolved IP limits the ability to map the full infrastructure, but the shared address is consistent with other known malicious sites hosted on the same cloud provider network.

Defenders should immediately block DNS resolution for tresr-io-sart-info.pages.dev at the network perimeter and add the IP address 172.66.47.109 to any outbound filtering rules that restrict connections to suspicious hosts. Endpoint protection platforms should be updated to include the 17 vendor detections reported by VirusTotal, and security information and event management (SIEM) rules should be tuned to generate alerts on any authentication attempts or credential submissions directed to this domain. Continuous monitoring of the host on threat‑intel feeds is advised, as the active status indicates that the infrastructure may still be leveraged in ongoing campaigns.