guide-logon-trazor[.]pages[.]dev

Analysis of guide-logon-trazor.pages.dev shows a newly registered domain (created 23 March 2026) that is currently taken offline (HTTP 403) but was previously used to host a Trezor‑branded login page titled “Trezor Wallet Login — Secure Access to Your Hardware Wallet”. The site was registered through Cloudflare, Inc. and resolves to the Cloudflare IP address 172.66.47.159, located in Canada. DNS resolution uses the Cloudflare nameservers christina.ns.cloudflare.com and keaton.ns.cloudflare.com, and the service presented an SSL certificate issued by Google Trust Services under the WE1 root, indicating a legitimate‑looking HTTPS connection. Technical fingerprints include enforced HSTS, Cloudflare edge protection, and HTTP/3 support.

Security‑vendor scanning on VirusTotal recorded three detections out of ninety‑four scanners, and the domain appears on a single security blocklist. Gridinsoft assigned a trust score of 0 / 100, and PhishDestroy has actively blocked the domain. The page explicitly impersonates the Trezor hardware‑wallet brand, confirming a crypto‑scam intent. Uncertainty remains around the exact phishing kit used and the presence of any additional command‑and‑control infrastructure, as no further artifact URLs or payload samples have been disclosed.

Defenders should add the domain to internal blocklists, monitor for any resurgence of the same IP or Cloudflare nameserver patterns, and enforce strict credential‑validation controls for Trezor‑related services. Threat‑intel feeds should be updated to reflect the association with the “Crypto Scam” category, and any outbound traffic to the resolved IP should be inspected for anomalous activity. Continuous re‑scanning is advised should the site become active again, given its low trust score and partial vendor detections.