trezor-login-currency[.]pages[.]dev

PhishDestroy has analyzed the domain trezor-login-currency.pages.dev and identified it as a brand impersonation phishing threat targeting users of the cryptocurrency hardware wallet company Trezor. The domain employs deceptive naming to trick victims into believing they are accessing an official Trezor login portal, potentially to steal sensitive credentials and seed phrases. This fraudulent site was registered through Cloudflare, Inc. and resolves to IP address 188.114.96.3. Security analysis reveals that 12 out of 95 antivirus vendors on VirusTotal flag this domain as malicious, and it appears on at least one security blocklist. The domain was created on September 09, 2025, and its SSL certificate is issued by Google Trust Services. Notably, Google Safe Browsing (GSB) status is not currently flagged, but the page title displayed is "Suspected phishing site | Cloudflare," indicating that hosting provider Cloudflare has taken action.

The current status of trezor-login-currency.pages.dev is offline, meaning the phishing site has been taken down, likely due to Cloudflare's intervention after reports of fraudulent activity. The risk associated with this domain remains at an elevated level because while the site is no longer accessible, similar clones may reappear under different domains. Users who may have visited the site before takedown should immediately change their Trezor-related passwords and enable two-factor authentication. Additionally, it is critical to never enter seed phrases or private keys on any website. PhishDestroy recommends monitoring cryptocurrency accounts for unauthorized transactions and reporting any suspicious activity to Trezor support. Remaining risk includes the potential for phishing emails or social engineering attempts directing users to similar fraudulent domains. The use of the unique seed 95c982 helps track this specific campaign for future analysis.