download-trezar[.]pages[.]dev

The domain download-trezar.pages.dev was registered on March 27, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.44.222, which is hosted on Cloudflare's edge network. The zone is delegated to the Cloudflare nameservers kimora.ns.cloudflare.com and kip.ns.cloudflare.com. Internal threat feeds have flagged the domain as part of a credential‑harvesting campaign; it is listed on one public security blocklist and has been actively blocked by the PhishDestroy filtering service. VirusTotal records show that the site has been scanned by 91 antivirus and URL‑reputation vendors, yet none have raised a detection at the time of analysis.

Absence of a detection does not imply safety, and the lack of a positive result is consistent with many newly deployed phishing infrastructures that evade static signatures. Publicly available observations do not include a retrieved page title, SSL certificate details, or HTTP response codes, so the exact content served by the site remains unverified. Consequently, the current confidence in the phishing intent relies on the domain’s recent creation, its association with known phishing blocklists, and the pattern of Cloudflare‑hosted domains used in credential‑stealing operations. The short lifespan and the use of a sub‑domain under pages.dev suggest an attempt to benefit from the reputation of the parent domain while keeping registration costs low.

Defenders should treat any traffic to download-trezar.pages.dev as malicious. Recommended actions include adding the domain to local deny lists, ensuring web‑gateway and DNS filtering solutions block the IP 172.66.44.222, and monitoring for any related sub‑domains that share the same nameserver set. Continuous re‑evaluation is advised as additional telemetry becomes available, particularly if the site begins serving HTTP responses or is observed in phishing‑email campaigns.