trezordrainer[.]pages[.]dev

The domain trezordrainer.pages.dev was registered on 12 May 2025 and is currently active. It is flagged for brand impersonation of the hardware wallet provider Trezor. The site resolves to the Cloudflare edge address 104.21.64.1 and uses the Cloudflare nameservers kenia.ns.cloudflare.com and apollo.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services under the WE1 designation, indicating a valid TLS handshake for the host.

Technical inspection shows the site enforces HTTP Strict Transport Security and serves content over HTTP/3, both typical of Cloudflare‑protected services. An HTTP request returns status code 500 and the page title reported by the server is “Worker threw exception | trezordrainer.pages.dev | Cloudflare”, suggesting a misconfigured Cloudflare worker rather than a legitimate application. No additional technologies beyond HSTS, Cloudflare, and HTTP/3 were observed.

The threat profile classifies the domain as a cryptocurrency‑related impersonation campaign. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. Despite a clean VirusTotal result (0/95 detections), the combination of brand targeting, active hosting, and a low trust score warrants continued scrutiny. The risk level is listed as under_investigation, reflecting insufficient public evidence to assign a final severity.

Defenders should add trezordrainer.pages.dev to network deny lists and monitor DNS queries for the associated IP 104.21.64.1. Email and web gateway filters ought to flag any URLs containing the domain or its sub‑domains. Continuous threat‑intel feeds should be consulted for updates, and any traffic attempting to interact with Trezor‑related services from this host should be blocked or sandboxed for further analysis. Ongoing observation of the Cloudflare worker behavior may reveal additional malicious payloads.