project-trezo-io[.]pages[.]dev

This domain, project-trezo-io.pages.dev, is flagged as a brand_impersonation phishing infrastructure targeting Trezor, a cryptocurrency hardware wallet provider. Analysis of the page title, 'Trezor @Login – Secure Your Crypto@ Journey,' indicates an attempt to deceive users into believing they are accessing an official Trezor login portal. No explicit drainer kit signatures were identified in the available metadata, though the page structure aligns with common credential-harvesting phishing kits used in crypto-themed attacks. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 24, 2026, and resolves to the IP address 172.66.45.2, hosted in a Cloudflare data center located in California. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing domains leveraging Cloudflare Pages. Detection metrics show 12 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and was previously blocked by PhishDestroy. Google Safe Browsing (GSB) status was not explicitly provided, but the domain’s inclusion in multiple detection feeds suggests prior active malicious classification. As of the latest verification, project-trezo-io.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or security teams. While the immediate threat is mitigated, residual risk remains for users who may have interacted with the domain prior to its takedown. Organizations and individuals are advised to monitor for unauthorized access attempts linked to Trezor credentials and implement multi-factor authentication (MFA) on all crypto-related accounts. Network defenders should update blocklists to include this domain and its associated IP address, while users should verify the authenticity of any Trezor-related communications by cross-referencing official channels.