page-trzer[.]pages[.]dev

The domain page-trzer.pages.dev was registered on February 21 2026 through Cloudflare, Inc. and immediately placed on Cloudflare’s DNS infrastructure, using the authoritative nameservers troy.ns.cloudflare.com and dora.ns.cloudflare.com. The site presented the page title “Suspected phishing site | Cloudflare”, which is a standard warning page displayed by Cloudflare when a URL is flagged for abuse. Infrastructure analysis shows the domain resolves to the IP address 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. located in the United States. The service was configured with HTTP Strict Transport Security and HTTP/3, and the TLS certificate was issued by Google Trust Services under the WE1 profile, indicating a valid, publicly trusted certificate despite the malicious classification.

The domain is currently taken offline, returning an HTTP 403 response and listed as blocked by the PhishDestroy sinkhole. Nevertheless, it appears on at least one public security blocklist, and three of ninety‑three VirusTotal scanners flagged the host as malicious. Independent reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, reinforcing the assessment of a high‑confidence credential‑phishing operation. The scam type is explicitly identified as credential phishing, though the target brand or login page details have not been disclosed in the available intelligence.

Uncertainty remains regarding any active payload or the specific credentials being harvested, as no content analysis of the landing page has been captured. Defenders should therefore enforce a deny rule for page‑trzer.pages.dev at perimeter and endpoint layers, continue to monitor the IP address 188.114.96.3 for potential re‑use, and ensure that any future resolution to Cloudflare‑hosted services is inspected with URL‑reputation services.