tenzor-suite-welt[.]pages[.]dev

Analysis as of July 29, 2026 indicates that the domain tenzor-suite-welt.pages.dev is actively serving a generic phishing campaign. VirusTotal records show that nine out of ninety‑one scanned security vendors have flagged the domain as malicious, providing a modest but notable detection signal. The domain is currently listed on a single external security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing the assessment of malicious intent. Registration information reveals that the domain was provisioned through Cloudflare, Inc., and the authoritative name servers are gemma.ns.cloudflare.com and robert.ns.cloudflare.com, both operated by Cloudflare.

DNS resolution points to the IP address 172.66.44.157, which belongs to Cloudflare’s edge network and therefore masks the true backend hosting environment. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available in the current dataset, leaving the exact content and credential‑harvesting mechanisms unverified. The lack of visible page metadata means that analysts cannot confirm which brand or service is being spoofed, but the classification as generic phishing aligns with the observed indicators.

Defenders should immediately add tenzor-suite-welt.pages.dev to URL filtering rules, enforce blocklist entries for the associated IP range, and monitor for any related traffic patterns. Continuous re‑scanning on VirusTotal and periodic checks of Cloudflare’s DNS records are recommended to detect any changes in hosting or detection status. Given the elevated risk rating, organizations handling sensitive credentials should treat any interaction with this domain as malicious.