home-logi-trzrr[.]pages[.]dev

This domain, home-logi-trzrr.pages.dev, is flagged as a brand impersonation threat targeting Trezor, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to mimic the official Trezor login interface, as evidenced by the page title "Trezor @Login – The Official Wallet | Trezor®." Such impersonation domains are commonly used to facilitate credential theft or crypto drainer attacks, where victims unknowingly surrender wallet access or private keys to malicious actors. No specific drainer kit signatures were identified in the available data, but the domain’s structure and branding suggest intent to deceive users into entering sensitive information. Technical indicators confirm elevated risk. The domain was registered on April 12, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.203. It is detected by 1 out of 95 security vendors on VirusTotal, and appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), which is consistent with legitimate domains but does not mitigate the impersonation risk. Google Safe Browsing (GSB) status is not explicitly provided, but the low detection rate and limited blocklist presence suggest the domain may have evaded broader scrutiny prior to takedown. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for similar attacks. Users who accessed the domain prior to its takedown should assume credential exposure and take immediate action: revoke any wallet authorizations, monitor for unauthorized transactions, and rotate passwords or recovery phrases associated with Trezor or other crypto services. Organizations should update blocklists to include this domain and its associated IP to prevent future access. The remaining risk stems from potential reuse of the domain or infrastructure for additional phishing campaigns.