dashboard--trzor-en-us[.]pages[.]dev

PhishDestroy has flagged dashboard--trzor-en-us.pages.dev for active brand impersonation of Trezor, the cryptocurrency wallet provider. The malicious domain leverages a spoofed ‘Trezor Wallet Start Guide’ landing page with a title designed to mislead users into surrendering sensitive credentials. While no drainer kit artifacts were identified during initial triage, the use of a Google Trust Services SSL certificate and a Cloudflare-based infrastructure strongly suggests a coordinated deception campaign targeting Trezor users. The page remains accessible and appears to be actively soliciting wallet-related inputs despite having no current detections across 95 VirusTotal engines.

Technical indicators confirm elevated concern: the domain resolves to IP 172.66.47.97 via Cloudflare, Inc. registration, exhibits 2/95 VirusTotal detections, and utilizes a legitimate Google Trust Services SSL certificate. No blocklist entries were recorded at the time of analysis, indicating this is a newly observed threat with minimal prior exposure. The absence of detections, combined with a convincing impersonation of Trezor’s branding, underscores the sophistication of this attack vector. Given that the domain was registered through Cloudflare’s Pages service, threat actors are exploiting legitimate deployment platforms to host malicious content with reduced friction and faster propagation.

The domain is currently active and no remediation has been applied. Users are strongly advised to avoid interaction and verify destination URLs before entering any sensitive information. Security teams should block the domain at the network perimeter and investigate endpoints that may have accessed it. While risk remains under investigation pending additional telemetry, the configuration and infrastructure suggest an imminent threat to cryptocurrency holders. Immediate containment actions are recommended to prevent credential harvesting and potential fund loss. Remaining risk is assessed as high due to the domain’s active status, low detection rate, and alignment with known crypto-wallet targeting campaigns.