trezor-login-web[.]pages[.]dev

trezor-login-web.pages.dev was observed targeting the Trezor brand by presenting a page titled “Suspected phishing site | Cloudflare”. The domain was created on February 21 2026 and registered through Cloudflare, Inc. It resolves to the Cloudflare edge address 188.114.97.3, which is located in the United States and belongs to ASN 13335 (Cloudflare, Inc.). The site leveraged Cloudflare’s security stack, as indicated by the presence of HTTP Strict Transport Security (HSTS), HTTP/3 support, and a TLS certificate issued by Google Trust Services (WE1). An HTTP request to the host returned a 403 status code, confirming that the content is not publicly accessible at the time of analysis.

Reputation services provide divergent scores: Scamadviser assigned a trust rating of 41 / 100, while Gridinsoft reported 0 / 100. The domain is listed on a single security blocklist, PhishDestroy, and VirusTotal flagged the site in 11 of 95 scanning engines. Nameservers are ram.ns.cloudflare.com and stevie.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. The infrastructure pattern—brand‑impersonation using a Cloudflare‑registered sub‑domain and a generic IP address from Cloudflare’s edge network—is consistent with campaigns that hide malicious origin servers behind a trusted CDN.

No further technical details about the payload, phishing kit, or victim interaction are available because the site is currently offline. Defenders should block the domain and its associated IP address (188.114.97.3) at network and endpoint layers, incorporate the domain into URL filtering policies, and monitor for any new sub‑domains registered with the same registrar that reference the Trezor brand. Threat‑intel teams should record the association with the Crypto Scam classification and continue to track Cloudflare‑hosted domains exhibiting similar naming conventions for early detection of related campaigns.