trezor-ardwarewallet[.]pages[.]dev

Analysis of the domain trezor-ardwarewallet.pages.dev indicates it is a crypto scam impersonating Trezor, a hardware wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and is hosted on Cloudflare’s infrastructure, resolving to the IPv6 address 2606:4700:3030::6815:1001 within AS13335. The site was flagged by eight of ninety-three security vendors on VirusTotal, though the specific detection rules are not disclosed in the available data. It appears on one security blocklist and has been assigned a Gridinsoft trust score of 0/100, further corroborating its malicious classification. The SSL certificate is issued by Google Trust Services (WE1), and the domain employs Cloudflare nameservers (lilith.ns.cloudflare.com and brett.ns.cloudflare.com), along with HTTP/3 and HSTS technologies, which are consistent with modern phishing infrastructure designed to evade detection and appear legitimate.

The page title, 'Suspected phishing site | Cloudflare,' suggests that Cloudflare’s internal systems have flagged the domain as suspicious, leading to its current HTTP 403 status, which indicates the content is inaccessible. Scamadviser assigns a trust score of 41/100, reflecting low confidence in the domain’s legitimacy. The scam type is explicitly categorized as a crypto scam, aligning with the impersonation of Trezor, a known target for wallet-draining and credential-harvesting campaigns. No evidence of a specific phishing kit or additional infrastructure (e.g., redirect chains, associated domains) is present in the available data, limiting further attribution.

Defenders should treat this domain as confirmed malicious. The combination of brand impersonation, low trust scores, and detection by multiple security vendors warrants immediate blocking at the network and endpoint levels. Given the domain’s association with Cloudflare Pages, organizations may also monitor for similarly structured subdomains (e.g., [brand]-*.pages.