logo-trezor-main[.]pages[.]dev

PhishDestroy identifies the domain logo-trezor-main.pages.dev as an active Trezor brand impersonation phishing campaign targeting cryptocurrency wallet users. This domain leverages Cloudflare Pages hosting to mimic official Trezor branding, increasing the likelihood of credential theft or malware delivery. The campaign is currently active and employs domain spoofing techniques to deceive victims into entering sensitive information.

This domain was flagged by 6 of 95 VirusTotal security vendors, indicating elevated risk despite low detection spread. Registered through Cloudflare, Inc., the domain resolves to IP address 172.66.46.211 and holds an SSL certificate issued by Google Trust Services, enhancing its perceived legitimacy. The combination of trusted infrastructure (Cloudflare, Google Trust Services) and low but notable detection rates suggests a sophisticated campaign designed to evade initial scrutiny while maintaining operational persistence.

Given the active status and specific targeting of Trezor users, the risk to cryptocurrency holders remains elevated. PhishDestroy recommends immediate domain blocking at network and endpoint levels due to the credible impersonation and active hosting infrastructure. Users should verify all communication purporting to be from Trezor via official channels and avoid interacting with this domain or any linked content. Security teams are advised to monitor for associated IP addresses and implement DNS-based threat intelligence feeds to prevent downstream compromise.