trizor-s[.]pages[.]dev

Analysis of trizor-s.pages.dev shows a high‑risk, active brand‑impersonation campaign targeting Trezor. The domain was registered on May 01 2026 and is hosted behind Cloudflare infrastructure, resolving to IP 188.114.97.3 in Canada. DNS is served by coby.ns.cloudflare.com and venus.ns.cloudflare.com, and the site enforces HSTS while supporting HTTP/3. TLS termination is provided by a Google Trust Services certificate issued to WE1, indicating a valid HTTPS connection. The page title presented by the server – “Trezor Suite App (Official) | Desktop & Web Crypto Management” – directly references the Trezor brand, confirming the impersonation intent. Security telemetry shows a Gridinsoft trust score of 0 / 100, and VirusTotal recorded detections from 10 of 91 scanned engines, reinforcing the malicious classification. The domain appears on one public blocklist and is already blocked by PhishDestroy, reflecting community‑wide recognition of the threat. While the content of the landing page has not been inspected, the observable indicators (brand‑specific title, low trust score, multiple vendor detections, and active blocking) provide sufficient evidence to deem the site a confirmed phishing vector. Defenders should immediately block the domain at network and endpoint layers, add it to URL filtering policies, and monitor for any related infrastructure that may share the same Cloudflare IP or nameservers. Users should be warned not to interact with any links or credential prompts originating from this domain.