logn-trezr-dev[.]pages[.]dev

The domain logn-trezr-dev.pages.dev was registered on February 21, 2026 via Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.153, located in the United States under ASN 13335. The site presents the page title "Suspected phishing site | Cloudflare," indicating that the hosting provider has flagged the content as potentially malicious. Infrastructure analysis shows the domain is protected by Cloudflare services, including HSTS and HTTP/3, and uses a Google Trust Services / WE1 SSL certificate, confirming the presence of a valid TLS layer. Nameserver records point to june.ns.cloudflare.com and dean.ns.cloudflare.com, both Cloudflare‑operated.

VirusTotal scans returned three positive detections out of ninety‑three security vendors, reinforcing the suspicion of abuse. A Gridinsoft trust score of 0 / 100 further corroborates the malicious assessment. The HTTP response returned a 403 status code, suggesting that access to the site is currently blocked or the page has been taken offline. The domain appears on one security blocklist and has been explicitly blocked by PhishDestroy, indicating that defensive feeds have recognized it as a threat.

The intelligence attributes the activity to brand impersonation targeting the cryptocurrency hardware‑wallet provider Trezor. While the available data confirm the domain’s malicious intent and its use of Cloudflare infrastructure, content‑level analysis is unavailable because the site is offline, leaving the exact phishing vector and payload unknown. Defenders should add logn-trezr-dev.pages.dev to domain blocklists, monitor for any future resolution changes, and watch for similarly crafted subdomains that leverage Cloudflare’s CDN to mimic legitimate brand assets. Continuous telemetry from DNS and URL filtering solutions is recommended to detect re‑appearance or related campaigns.