connect-trezo--page-devs-light[.]pages[.]dev

This domain, connect-trezo--page-devs-light.pages.dev, poses a direct threat as a brand impersonation attempt targeting Trezor cryptocurrency wallet users. The page mimics the official Trezor login interface, displaying the title 'Trezor Login® | Getting Started' to deceive victims into entering sensitive credentials or recovery phrases. Such infrastructure is commonly used to facilitate crypto drainer attacks, where unauthorized transactions are executed once credentials are harvested. The domain’s design and naming convention closely resemble legitimate Trezor services, increasing the likelihood of successful social engineering against unsuspecting users seeking wallet access or support. Analysis of the domain’s infrastructure reveals several technical indicators supporting its malicious nature. The domain was registered on April 22, 2026, through Cloudflare, Inc., a registrar frequently leveraged by threat actors to obscure ownership and hosting details. Despite its suspicious characteristics, the domain has not been widely flagged, with only 0 out of 95 VirusTotal engines detecting it as malicious at the time of assessment. It appears on a single security blocklist, indicating limited but growing awareness of its threat. The domain resolves to the IP address 172.66.47.175 and employs technologies such as HSTS, Cloudflare CDN, and HTTP/3, which are often used to enhance perceived legitimacy. The SSL certificate is issued by Google Trust Services, further blending in with legitimate web traffic. Users who visited connect-trezo--page-devs-light.pages.dev should assume their credentials or recovery phrases may have been compromised. Immediate actions include revoking any active sessions, generating new wallet addresses, and transferring assets to a secure, unaffected wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If sensitive information was entered, consider the associated wallet or accounts fully compromised. Report the domain to relevant security teams and blocklists to prevent further exploitation. Future vigilance is advised when accessing cryptocurrency services, particularly verifying domain authenticity and SSL certificates before entering credentials.