supports-trzro-eng[.]pages[.]dev

Analysis conducted on July 29, 2026 examines the domain supports-trzro-eng.pages.dev, which is currently classified as a generic phishing site with elevated risk. The domain resolves to the IP address 188.114.97.3 and is hosted behind Cloudflare’s infrastructure; registration is listed under Cloudflare, Inc., and the authoritative name servers are lee.ns.cloudflare.com and monroe.ns.cloudflare.com. VirusTotal has recorded detections from 11 of 91 scanning engines, indicating that a notable minority of security products identify malicious behavior associated with the domain.

Additionally, the domain appears on a single external blocklist and has been flagged by the PhishDestroy blocklist service, reinforcing the consensus that it is being used for malicious purposes. Publicly available intelligence does not include a page title, SSL certificate details, or explicit indications of the targeted brand or scam kit, so the exact content served by the site remains unverified. The lack of visible branding or a described lure means that defenders cannot rely on visual cues to confirm the phishing vector, but the combined technical indicators—malicious detections, blocklist presence, and hosting under a shared-service provider—justify continued monitoring.

Organizations should block DNS resolution to supports-trzro-eng.pages.dev at the network perimeter, add the domain to URL filtering rules, and ensure endpoint security solutions are updated to include the 11 vendor detections reported by VirusTotal. Ongoing reconnaissance should track any changes to the IP address, name-server configuration, or additional blocklist listings that could signal a shift in the threat actor’s infrastructure.