guide-en-trztt[.]pages[.]dev

guide-en-trztt.pages.dev is an active domain registered on 25 March 2026 that hosts a counterfeit login page titled “Trezor Login — Secure Access to Your Hardware Wallet”. The page is crafted to imitate the official Trezor portal, indicating a brand‑impersonation campaign designed to harvest credentials from cryptocurrency‑wallet users. The incident is classified as high risk and the site continues to respond with HTTP 200, confirming its availability for malicious actors. Infrastructure analysis reveals that the domain is delegated to the Cloudflare, Inc. nameservers ajay.ns.cloudflare.com and virginia.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which is geolocated to Canada and belongs to Cloudflare’s edge network. The TLS certificate is issued by Google Trust Services under the WE1 root, providing a legitimate‑looking HTTPS connection. The web server employs modern protocols, including HTTP/3, and enforces HSTS while loading Google Analytics scripts, indicating a fully functional front‑end. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal records 10 out of 95 security vendors flagging the domain as malicious. The domain is listed on one public blocklist and has already been blocked by PhishDestroy, confirming that threat‑intel feeds have identified it as a malicious resource. Defenders should immediately add guide-en-trztt.pages.dev to network deny‑list and endpoint filtering policies, and consider TLS inspection for traffic to the associated Cloudflare IP range to uncover hidden payloads. Monitoring for new “pages.dev” subdomains that reference Trezor or similar hardware‑wallet terminology is recommended, as this pattern aligns with recent credential‑stealing operations. Prompt blocking and continuous surveillance will mitigate exposure to credential theft targeting Trezor users.