official---begin--trojor[.]pages[.]dev

This domain, official---begin--trojor.pages.dev, is flagged as a brand impersonation phishing site. It was registered on February 21, 2026, through Cloudflare, Inc., and resolves to IP 172.66.44.466 (AS13335 Cloudflare, US). The domain uses Cloudflare infrastructure including HSTS, HTTP/3, and nameservers mitch.ns.cloudflare.com and chin.ns.cloudflare.com. Its SSL certificate is issued by Google Trust Services (WE1). The page title as observed on the report date of July 24, 2026, was 'Suspected phishing site | Cloudflare', indicating that Cloudflare had already blocked access and displayed a warning page.

The HTTP status returned was 403 Forbidden. The Gridinsoft trust score is 0/100, reflecting high risk. One of 93 security vendors on VirusTotal flagged this domain as malicious. It appears on one security blocklist and is blocked by PhishDestroy. The domain is currently offline, meaning it is no longer serving content.

Defenders should note that while the exact brand being impersonated is not specified in the available data, the classification as brand impersonation suggests the site likely attempted to mimic a known company. The domain's registration through Cloudflare and use of Cloudflare's reverse proxy makes it harder to trace the true origin. Security teams should ensure their blocklists include this domain and its associated IP, and monitor for similar naming patterns that use hyphens and the .pages.dev subdomain, as this infrastructure is commonly abused for phishing. No Safe Browsing or OTX data is available in this report. The domain is now offline, but defenders should remain vigilant for reactivation under a different subdomain or registrar.