trezor-hardwarewallet[.]pages[.]dev

trezor-hardwarewallet.pages.dev is a newly registered domain that surfaced on February 21 2026. The domain is hosted on Cloudflare’s network and resolves to IP 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. DNS resolution uses the Cloudflare‑provided authoritative nameservers “kara.ns.cloudflare.com” and “hugh.ns.cloudflare.com”. The site presents the page title “Suspected phishing site | Cloudflare” and returns HTTP 403 responses, indicating that the content is currently blocked by Cloudflare’s protective layer. An SSL certificate issued by Google Trust Services (CN=WE1) is active, confirming that HTTPS is correctly configured.

The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis shows that 12 of 93 scanned security vendors flag the host as malicious, reinforcing the suspicion that the site is being used for a crypto‑related scam. The Gridinsoft trust score is 0 / 100, and the identified scam type is “Crypto Scam”. The page employs HSTS, Cloudflare’s edge services, and HTTP/3, which are typical of legitimate Cloudflare‑protected sites but do not mitigate the malicious intent. Brand‑targeted analysis indicates that the domain attempts to impersonate the hardware‑wallet provider Trezor, aligning with the “brand impersonation” threat type and the elevated risk rating assigned by analysts.

No additional evidence such as login forms, credential‑stealing scripts, or malware payloads has been disclosed, so the exact payload or phishing flow remains unknown. Defenders should block the domain at the DNS level, monitor outbound connections to 188.114.97.3, and add the host to existing URL filtering policies. Organizations that use Trezor devices should alert users to the existence of this domain and advise against any interaction.