en-trrezzr[.]pages[.]dev

The domain en-trrezzr.pages.dev is actively impersonating the cryptocurrency wallet brand Trezor. It has been flagged as malicious by 11 out of 94 vendors on VirusTotal. This domain is hosted on an IP address (188.114.96.3) associated with Cloudflare, Inc., and it uses an SSL certificate issued by Google Trust Services. The domain was created and detected by PhishDestroy on March 24, 2026, the same day, indicating a rapid deployment of the phishing scheme.

The site presents itself as a legitimate Trezor wallet service, using the page title "Trezor® Wallet – Secure Bitcoin" to lure users into providing sensitive information. The platform risk score is notably high at 93 out of 100, reflecting the significant threat it poses. Despite being listed on only one public blocklist, the domain's malicious intent is clear from its impersonation tactics and the number of detections.

This phishing operation exploits the trust users place in Trezor's brand, aiming to harvest credentials or other sensitive data. The use of Cloudflare's infrastructure and a reputable SSL issuer like Google Trust Services adds a veneer of legitimacy, making it more challenging for users to identify the scam. The rapid detection by PhishDestroy highlights the importance of early threat identification, as phishing domains often exploit the time gap before antivirus databases update. This case underscores the critical need for continuous monitoring and swift action to mitigate such threats.