beinggterz[.]pages[.]dev

The domain beinggterz.pages.dev was registered on April 06, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada. The authoritative name servers are cortney.ns.cloudflare.com and zac.ns.cloudflare.com, confirming that the domain is hosted on Cloudflare’s network. An HTTPS connection is presented with a certificate issued by Google Trust Services (CN=WE1), indicating a valid TLS chain but offering no insight into the underlying content. An HTTP request to the site returns a 403 status code, and the page title reported by the scanner is “Trezor Hardware Wallet | Official Setup”, directly referencing the Trezor brand.

The intelligence classifies the activity as brand impersonation targeting Trezor, and the domain is listed on a single security blocklist. PhishDestroy has taken the domain offline, and the current status is reported as taken offline. The site was scanned by VirusTotal using 94 vendor engines, none of which raised a detection at the time of analysis. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low confidence rating.

While the TLS certificate and lack of detections might suggest a benign surface, the combination of a brand‑specific page title, the use of a reputable CDN, and the blocklist entry indicate a deliberate attempt to mimic official Trezor setup pages. Uncertainty remains regarding the actual payload or phishing form, as the site content could not be retrieved due to the 403 response. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host, and add the domain to internal threat‑intel feeds. Additional verification of the site’s content, should it become reachable, is recommended to confirm whether credential‑harvesting mechanisms are present.