cloud-trezor-wlt[.]pages[.]dev

This domain, cloud-trezor-wlt.pages.dev, was first observed on June 10, 2026 when it was registered through the Cloudflare Pages service. The domain is currently classified as an active crypto drainer with an elevated risk rating. Independent analysis by PhishDestroy has already placed the domain on its blocklist, and it also appears on an additional security blocklist, indicating that at least two independent sources have deemed the site malicious. VirusTotal scans show that 11 out of 91 security vendors flagged the domain as suspicious or malicious, providing further corroboration of its abusive intent.

The hosting environment is provided by Cloudflare Pages, which supplies a shared content‑delivery infrastructure and often masks the underlying origin IP, limiting immediate attribution of the operator’s network location. No public IP address, ASN, or geographic data has been disclosed, and SSL/TLS certificate details are not publicly visible beyond the default Cloudflare certificates. Likewise, the HTTP response status and page title have not been reported, leaving the surface‑level content of the site unverified.

The limited telemetry therefore restricts a deeper technical fingerprint, but the convergence of registration timing, hosting provider, blocklist inclusion, and multi‑vendor detection strongly suggests a coordinated campaign targeting cryptocurrency users. Defenders should proactively block cloud‑trezor‑wlt.pages.dev at perimeter and DNS layers, monitor outbound connections to Cloudflare edge nodes for anomalous traffic patterns, and consider adding the domain to internal threat intel feeds. Continuous re‑evaluation is recommended, as further analysis may reveal additional indicators such as malicious scripts, credential‑phishing endpoints, or wallet‑draining payloads.