auth-trezer-en[.]pages[.]dev

Analysis of auth-trezer-en.pages.dev indicates that the domain is actively used for generic phishing campaigns. The domain was registered on 7 November 2025 through Cloudflare Pages, a platform that supplies shared hosting and automatically provisions TLS certificates. DNS resolution points to the IP address 188.114.96.3, which is owned by Cloudflare’s edge network and is commonly leveraged by malicious actors to hide behind legitimate infrastructure. Google Safe Browsing classifies the site as a social‑engineering threat, and the independent service PhishDestroy has placed the domain on its blocklist.

In addition, one public blocklist contains the domain, and VirusTotal reports that 12 out of 91 scanned security vendors have flagged it as malicious. These independent detections collectively raise the risk rating to high. No public information is available regarding the HTTP response code, certificate details, page title, or the specific brand being spoofed, limiting attribution beyond the generic phishing label. The lack of such telemetry means defenders cannot rely on content‑based signatures alone.

Given the confirmed presence on reputable blocklists and the Cloudflare‑based hosting, the recommendation for security teams is to block the domain at the network perimeter, add it to proxy and DNS filtering rules, and monitor for any outbound connections to the associated IP address. Continuous re‑scanning with multi‑vendor scanners is advised to capture any changes in detection status. Organizations should also educate users about the risk of unsolicited login prompts that may originate from this domain, even though the exact content of the phishing page has not been publicly disclosed.