tree-zor-io[.]pages[.]dev

Analysis indicates that tree-zor-io.pages.dev is an active phishing domain hosted on Cloudflare Pages infrastructure. As of July 29, 2026, the domain resolves to IP address 188.114.97.3, which is part of Cloudflare's network. Eight of 91 security vendors on VirusTotal have flagged this domain, suggesting detection of malicious activity.

The domain appears on at least one security blocklist, specifically PhishDestroy, which further corroborates its classification as phishing-related. Infrastructure analysis reveals that the domain uses Cloudflare nameservers (razvan.ns.cloudflare.com and wren.ns.cloudflare.com) and was registered through Cloudflare, Inc. This configuration is consistent with threat actors leveraging Cloudflare's free hosting and CDN services to obscure their operations. While the exact content of the site has not been fully analyzed, the available evidence—including vendor detections and blocklist inclusion—supports its classification as a generic phishing domain targeting unspecified victims.

Defenders should treat this domain as elevated risk and consider blocking or monitoring traffic to tree-zor-io.pages.dev. Given its Cloudflare hosting, additional scrutiny of other *.pages.dev subdomains may be warranted to identify related malicious activity. No brand-specific targeting or phishing kit details are currently available in the observed data.