hardware-logn--trezr-en-usa[.]pages[.]dev

PhishDestroy identifies hardware-logn--trezr-en-usa.pages.dev as a credential phishing domain impersonating Trezor hardware wallets. The domain is currently active and engaged in a targeted phishing campaign designed to harvest user credentials for cryptocurrency hardware wallet accounts. This constitutes a confirmed credential harvesting phishing threat aimed at compromising financial assets under the guise of legitimate wallet authentication.

This domain was flagged by 7 of 95 VirusTotal vendors, indicating undetected status despite active malicious activity. It was registered through Cloudflare, Inc., resolves to IP 188.114.97.3, and operates under a Google Trust Services SSL certificate. The domain shows no prior blocklist presence and maintains high infrastructure trust scores, which may contribute to its evasion of detection systems. Current threat intelligence suggests rapid deployment and low historical detection, increasing the risk of successful user compromise.

This domain remains active and poses an immediate risk to users entering wallet credentials. PhishDestroy recommends blocking access to the domain at the network level and avoiding interaction entirely. Users who may have entered credentials should immediately reset wallet passwords, enable two-factor authentication, and transfer assets to a new hardware wallet if suspicion arises. Security teams should monitor IP 188.114.97.3 and update blocklists accordingly. Further investigation is ongoing, and this assessment may escalate as additional data is collected.