connect--trzor-doc-ui-bfx[.]pages[.]dev

The domain connect--trzor-doc-ui-bfx.pages.dev has been identified as a high-risk brand impersonation threat, specifically targeting the Trezor cryptocurrency hardware wallet brand. This site poses as an official Trezor login page, using the title "Trezor Login® | Starting Up Your Device®" to trick users into entering sensitive credentials. The threat is classified as brand impersonation with a high risk level, and the page is still active at the time of analysis.

Technical indicators confirm the malicious nature of this domain. VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. The domain was registered through Cloudflare, Inc. on April 4, 2026, and resolves to IP address 188.114.97.3. It currently appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). The domain's registration date and content strongly suggest it was created specifically for phishing operations.

As of the latest check, the phishing page remains active and accessible, posing an ongoing risk to Trezor users. Response actions should include immediate reporting to security blocklists and the brand's security team. Users who may have visited the site should change their Trezor passwords and enable two-factor authentication. The primary risk is credential theft leading to potential cryptocurrency loss. PhishDestroy advises all users to verify URLs carefully and only access official Trezor domains directly.