terzor-sute[.]pages[.]dev

The domain terzor-sute.pages.dev was first registered on 21 February 2026 through Cloudflare, Inc. It resolves to the Cloudflare‑provided address 188.114.96.3, which is announced by ASN 13335 and geolocated to the United States. The site presents the HTTP status code 403 and the page title “Suspected phishing site | Cloudflare”, indicating that Cloudflare’s protective interstitial has been triggered. The hosting environment uses HSTS, HTTP/3, and standard Cloudflare services; the TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. The domain appears on a single security blocklist, specifically flagged by PhishDestroy, and has been assigned a Gridinsoft trust score of 0 out of 100.

VirusTotal analysis shows that 1 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious intent. Nameservers are arturo.ns.cloudflare.com and nadia.ns.cloudflare.com, both typical of Cloudflare‑hosted domains. As of the latest check on 25 July 2026 the site is listed as offline, and the HTTP 403 response suggests that the phishing page has been taken down or is no longer reachable.

However, the existence of the domain, its recent creation date, and its detection by a blocklist indicate that it was actively used in a generic phishing campaign at some point. Defenders should add terzor-sute.pages.dev to inbound and outbound filtering rules, monitor for any resurgence of activity, and consider sharing the indicator with threat‑sharing communities. Continuous re‑evaluation is advised, as the domain could be re‑activated or repurposed under the same Cloudflare infrastructure.