trezur-io-aws[.]pages[.]dev

This domain is flagged for brand_impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The site mimics legitimate Trezor interfaces to deceive users into entering sensitive credentials, such as recovery seeds or private keys, which could lead to unauthorized access to digital assets. Analysis indicates the domain is designed to exploit trust in the Trezor brand, potentially resulting in financial theft or account compromise. Infrastructure analysis reveals the domain was registered on April 4, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains. Detection metrics show 0/95 detections on VirusTotal, indicating limited initial flagging by security vendors. However, the domain appears on one security blocklist, and its Gridinsoft trust score is 0/100, suggesting high-risk activity. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious intent. Users who visited trezur-io-aws.pages.dev should immediately cease all interaction with the site. If credentials or recovery seeds were entered, affected individuals must transfer assets to a new, secure wallet and revoke access to any compromised accounts. Monitor financial transactions for unauthorized activity and enable multi-factor authentication on all related accounts. Report the incident to the legitimate service provider for further mitigation guidance. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts targeting cryptocurrency platforms.