en-treizor-io[.]pages[.]dev

The domain en-treizor-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2d2b, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and is classified as a credential phishing operation. An SSL certificate issued by Google Trust Services (WE1) is in place, and the site enforces HSTS while supporting HTTP/3, confirming a modern Cloudflare‑provided infrastructure. VirusTotal analysis shows that 12 of 93 security vendors have flagged the domain, indicating a non‑trivial detection consensus.

Google Safe Browsing has marked the domain for social engineering, and the site appears on a single security blocklist, with PhishDestroy explicitly blocking it. Reputation services reflect low confidence: Scamadviser assigns a trust score of 41 / 100, and Gridinsoft rates it 0 / 100. The nameservers are norm.ns.cloudflare.com and elle.ns.cloudflare.com. An HTTP 403 response was observed before the domain was taken offline, and the current status is listed as offline.

Defenders should immediately add en-treizor-io.pages.dev to URL filtering and DNS blocklists, monitor for any re‑activation, and correlate any authentication attempts against corporate credentials with this indicator. Given the Cloudflare hosting, consider applying strict outbound filtering for traffic to Cloudflare‑owned IP ranges that are not required for legitimate services. Continuous re‑assessment is advised, as the underlying infrastructure could be repurposed for future phishing campaigns.