home-io-trzor[.]pages[.]dev

Analysis of the domain home-io-trzor.pages.dev indicates an active phishing campaign targeting users of Trezor hardware wallets. The domain was registered through Cloudflare Pages on October 16, 2025, and remains operational as of July 29, 2026. Infrastructure analysis reveals the site is hosted on Cloudflare's content delivery network, a common tactic to obscure the true origin of phishing pages and leverage the provider's SSL certificates for perceived legitimacy. Detection metrics from VirusTotal show 14 of 91 security vendors flagging the domain as malicious, a detection rate consistent with newly identified phishing sites that have not yet been widely blocklisted.

The domain appears on at least one security blocklist, specifically PhishDestroy, which classifies it as a phishing threat. No additional blocklist data, such as Google Safe Browsing or Open Threat Exchange (OTX) listings, is currently available. The lack of broader blocklist inclusion may reflect the campaign's relatively recent activation or limited exposure. The domain's structure, incorporating 'trzor'—a misspelling of 'Trezor'—suggests an intent to deceive users attempting to access the legitimate Trezor wallet interface, though the exact content of the page has not been analyzed for specific phishing mechanisms such as credential harvesting or cryptocurrency address substitution.

Defenders are advised to treat this domain as an elevated-risk threat due to its active status, Cloudflare-hosted infrastructure, and confirmed detection by multiple security vendors. Network-level blocking of the domain is recommended, along with monitoring for related subdomains or newly registered lookalike domains. Organizations should also alert users to verify the authenticity of wallet-related communications and URLs, particularly those involving hardware wallet providers.