best-tresor-bridge[.]pages[.]dev

Analysis as of July 29, 2026 indicates that the domain best-tresor-bridge.pages.dev is actively being used for phishing. The domain is registered through Cloudflare, Inc. and is served by the Cloudflare nameservers bart.ns.cloudflare.com and dalary.ns.cloudflare.com. DNS resolution points to the IP address 172.66.47.182, which belongs to Cloudflare’s global edge network and is commonly leveraged by threat actors to hide infrastructure. The domain appears on a single public blocklist and is currently listed by PhishDestroy, confirming that at least one security-focused sinkhole has flagged it as malicious.

VirusTotal records show that the site was scanned by 91 antivirus and URL‑reputation engines; none of the engines returned a positive detection at the time of scanning. The absence of detections does not constitute evidence of benign intent, especially given the confirmed blocklist entry and the phishing classification supplied by threat intelligence. No additional evidence such as page titles, SSL certificate details, or HTTP response codes is presently available, leaving the surface‑web characteristics of the site unverified.

Defenders should treat the domain as hostile: block DNS resolution for best-tresor-bridge.pages.dev at network perimeter, add the IP 172.66.47.182 to any host‑based deny lists, and monitor outbound traffic for connections to Cloudflare edge nodes that may be used as fallback. Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any future changes in detection status. Organizations should also consider threat‑intel sharing with peers to accelerate detection of related infrastructure.