get-trezorstat-io[.]pages[.]dev

This domain, get-trezorstat-io.pages.dev, is identified as a credential harvesting infrastructure targeting users of Trezor hardware wallets. Analysis indicates the site employs brand impersonation tactics to deceive victims into submitting sensitive wallet credentials, including recovery seeds and private keys. The domain was designed to mimic legitimate Trezor interfaces, leveraging visual and structural similarities to lower user vigilance during authentication processes. No explicit drainer kit signatures were observed in initial scans, though the presence of dynamic form submission endpoints suggests automated exfiltration of stolen credentials to remote command-and-control servers. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.45.28, hosted on a Cloudflare-operated network (AS13335) in the United States. The SSL certificate is issued by Google Trust Services under the WE1 intermediate authority, a common configuration for Cloudflare Pages deployments. The domain was registered on October 9, 2025, through Cloudflare’s registrar services. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while two independent security blocklists have listed it for phishing activity. Google Safe Browsing status was not explicitly provided, though the domain’s inclusion in multiple threat intelligence feeds corroborates its malicious classification. At the time of assessment, get-trezorstat-io.pages.dev has been taken offline, with Cloudflare displaying a “Suspected phishing site” interstitial page. This action likely resulted from automated detection mechanisms or manual reporting by security researchers. Despite its current offline status, residual risk remains elevated due to the potential for credential replay attacks using previously harvested data. Users who interacted with the domain prior to takedown are advised to immediately rotate all Trezor-associated credentials, revoke active wallet sessions, and monitor transaction logs for unauthorized activity. Organizations should update internal blocklists to prevent future access attempts and consider implementing additional authentication layers for wallet recovery processes.