start-tzores-eng[.]pages[.]dev

Analysis of start-tzores-eng.pages.dev, conducted on July 25, 2026, identifies the domain as a credential phishing site with elevated risk. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolves to IP 188.114.96.3 (AS13335, Cloudflare, Inc., US). At the time of assessment, the domain was offline, returning an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare.' Infrastructure analysis reveals the use of Cloudflare nameservers (brianna.ns.cloudflare.com, syeef.ns.cloudflare.com), HSTS, and HTTP/3. The SSL certificate is issued by Google Trust Services (WE1).

Detection data indicates limited but targeted flagging: 3 of 93 security vendors on VirusTotal classified the domain as malicious, and it appears on one security blocklist (PhishDestroy). Gridinsoft assigned a trust score of 0/100, reinforcing the phishing classification. No additional brand targets or phishing kits were specified in available intelligence, and the exact content of the phishing page remains unanalyzed due to its offline status.

Defenders should treat this domain as a confirmed credential phishing threat. Recommended actions include blocking the domain and its resolving IP (188.114.96.3) at network perimeter controls, updating endpoint protection signatures, and monitoring for related indicators such as the SSL certificate issuer (Google Trust Services WE1) or Cloudflare-hosted subdomains with similar naming patterns. Given the domain's registration age and limited detection coverage, retrospective log analysis for connections to 188.114.96.3 or the domain itself is advised to identify potential prior compromise.