home-started-trzor-en[.]pages[.]dev

This domain, home-started-trzor-en.pages.dev, is flagged as an active phishing site targeting Trezor cryptocurrency wallet users. Infrastructure analysis reveals the domain was registered on October 16, 2025, and is hosted on Cloudflare Pages, a platform frequently abused for phishing due to its free hosting and SSL capabilities. The domain appears on one security blocklist, specifically PhishDestroy, and is detected by 12 of 91 security vendors on VirusTotal, indicating a consensus among multiple threat intelligence sources regarding its malicious nature.

The domain's structure, including the substring 'trzor'—a common misspelling of 'Trezor'—suggests an intent to deceive users attempting to access the legitimate Trezor hardware wallet site. While the exact content of the page remains unanalyzed, the combination of the domain name, hosting provider, and detection by security vendors strongly supports its classification as a phishing site. No additional details regarding the specific phishing kit, payload, or redirection mechanisms are currently available.

Defenders should treat this domain as high-risk and implement blocking measures at the network and endpoint levels. Organizations using Trezor or similar cryptocurrency wallets should alert users to avoid interacting with this domain and monitor for similar typosquatting attempts. Given the domain's recent creation and active status, further monitoring is recommended to track any changes in its infrastructure or associated threat indicators.