tersor-wlt-suite[.]pages[.]dev

Analysis as of July 29, 2026 indicates that the domain tersor-wlt-suite.pages.dev is actively leveraged in a generic phishing operation. The domain resolves to the IP address 172.66.46.228 and is registered through Cloudflare, Inc., with authoritative nameservers gerald.ns.cloudflare.com and malavika.ns.cloudflare.com. Threat intelligence from PhishDestroy confirms the domain is blocked, and it appears on a single security blocklist, reinforcing its malicious status.

VirusTotal scans report that 11 of 91 security vendors flag the domain as malicious, providing a modest but notable detection count that aligns with other observed indicators. No additional public evidence such as page title, SSL certificate details, or explicit brand targeting is currently available, leaving the exact phishing lure undefined. Defenders should prioritize immediate containment by adding the domain and its resolving IP to DNS and network blocklists, and consider sinkholing traffic to mitigate potential credential harvesting.

Continuous monitoring of Cloudflare name server changes and periodic re‑scanning with VirusTotal or similar services are advised to capture any evolution in the threat profile. Integration of this indicator into security information and event management (SIEM) rules will help surface attempted connections, and correlation with other phishing campaigns may reveal broader infrastructure reuse.