explorer-trezriostart[.]pages[.]dev

On 29 July 2026 the domain explorer-trezriostart.pages.dev was observed as an active phishing infrastructure. VirusTotal records show that 11 of 91 scanned security vendors flagged the domain as malicious, indicating a moderate consensus of compromise. The domain was created on 10 June 2026 and is hosted via Cloudflare Pages, a service that provides rapid static site deployment and can obscure the underlying origin server. It appears on a single public security blocklist and is currently blocked by the PhishDestroy feed, confirming that at least one trusted anti‑phishing provider has taken mitigation action.

No additional metadata such as IP address, autonomous system number, SSL certificate details, HTTP response codes, or page title have been published in the available intelligence. Consequently, the full surface‑level characteristics of the hosted content remain unknown, and automated content analysis cannot be performed at this time. The limited visibility underscores the need for defensive operators to rely on the existing indicators of compromise (IOCs) – namely the fully qualified domain name and its registration timestamp – when configuring detection rules.

Defenders should add explorer‑trezriostart.pages.dev to DNS and URL filtering policies, ensure that outbound traffic to the domain is denied, and monitor for any attempt to resolve or contact the host. Correlation with proxy or firewall logs for the creation date window may reveal early reconnaissance activity. Given the elevated risk rating, continuous reassessment is advised, and any future detections from additional scanners should be incorporated into existing blocklists.