trezooor-walet-us[.]pages[.]dev

On July 29, 2026 the domain trezooor-walet-us.pages.dev was identified as an active high‑risk generic phishing infrastructure. The domain is hosted on Cloudflare’s edge network and resolves to the IPv4 address 172.66.44.78. Cloudflare, Inc. is listed as the registrar, indicating the domain was provisioned through Cloudflare’s registration service. DNS resolution is served by the authoritative name servers damian.ns.cloudflare.com and kay.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure.

Reputation checks show the domain appears on one public security blocklist and is explicitly blocked by the PhishDestroy filtering service. Google Safe Browsing classifies the site as a social‑engineering threat, and VirusTotal reports that 12 of 91 scanned security vendors flag the domain as malicious. These detections suggest that the domain is being used to host phishing content, although the exact payload or targeted brand has not been publicly disclosed. The combination of Cloudflare‑based hosting, a single blocklist entry, and multiple vendor detections indicates a deliberately concealed phishing operation that leverages Cloudflare’s CDN to obscure the true origin of the malicious content.

Because the domain is still active, defenders should block DNS resolution to 172.66.44.78 and add trezooor-walet-us.pages.dev to local deny lists. Email security gateways should treat messages containing this domain as malicious, and web filtering solutions should enforce a block based on the Google Safe Browsing and PhishDestroy signals. Continuous monitoring of Cloudflare‑registered domains with similar naming patterns is recommended to catch future iterations of this infrastructure.