index-trezio-start[.]pages[.]dev

The domain index-trezio-start.pages.dev was registered through Cloudflare, Inc. on 21 February 2026 and is hosted on Cloudflare’s network (ASN 13335) with the address 172.66.45.14 located in the United States. DNS resolution uses the Cloudflare nameservers melissa.ns.cloudflare.com and mario.ns.cloudflare.com, and the site presents a Google Trust Services / WE1 TLS certificate. HTTP requests return a 403 status code and the page title returned by the server is "Suspected phishing site | Cloudflare", indicating that the content has been flagged by Cloudflare’s protective layer. Automated analysis by VirusTotal shows that three of ninety‑three security vendors have flagged the domain as malicious, and the site appears on a single security blocklist that is currently enforced by PhishDestroy.

The Gridinsoft trust score of 0 out of 100 further corroborates a low reputation. Detected technologies include HTTP/3, HSTS, and Cloudflare’s reverse‑proxy services, which are typical of infrastructure used for credential‑phishing campaigns. The intelligence classifies the activity as generic credential phishing, but no specific target brand is disclosed in the available metadata. Because the domain is already taken offline, active exploitation cannot be confirmed at this time; however, the observed indicators suggest that the infrastructure was prepared for credential harvesting.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the host name or related sub‑domains, and consider adding the IP address 172.66.45.14 to threat‑intel feeds. Ongoing correlation with other Cloudflare‑hosted phishing artifacts may reveal additional campaign overlap. The lack of further public samples limits deeper attribution, so continued observation of the associated nameservers and certificate issuance patterns is advised.