logn-tzr-office[.]pages[.]dev

Analysis of the domain logn-tzr-office.pages.dev indicates active brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The domain, registered on March 27, 2026, via Cloudflare Pages, resolves to IP address 188.114.97.3 (Cloudflare, Inc., Canada) and returns an HTTP 200 status, confirming operational accessibility. The page title, 'Trezor® Login — How to Access Your Trezor Wallet Securely,' explicitly aligns with Trezor’s branding, suggesting an intent to deceive users into submitting credentials or recovery phrases. Security vendor detections on VirusTotal report 9 of 94 engines flagging this domain as malicious. It appears on one security blocklist (PhishDestroy) and holds a Gridinsoft trust score of 0/100. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing domains frequently leverage valid certificates to appear legitimate. No evidence of a phishing kit or additional infrastructure has been confirmed at this stage. Defenders should prioritize blocking the domain and its resolving IP (188.114.97.3) at network and endpoint layers. Given the high-risk classification and active status, user education should emphasize verifying official Trezor domains (trezor.io) and avoiding login prompts from unsolicited sources. Further investigation into associated infrastructure or campaigns is recommended to identify linked threat actors or additional compromised assets.