trezurr-wallet-clasic[.]pages[.]dev

This domain, trezurr-wallet-clasic.pages.dev, is actively impersonating Trezor, a well-known cryptocurrency hardware wallet provider, to deceive users into disclosing sensitive credentials or transferring digital assets. The site mimics legitimate Trezor branding, including the use of registered trademarks in its page title, "Trezor Wallet® | Secure Your Crypto® IRA," to create a false sense of authenticity. Analysis indicates the domain is designed to harvest login credentials, seed phrases, or private keys, which could lead to unauthorized access and irreversible theft of cryptocurrency holdings. Infrastructure analysis reveals the domain was registered on October 13, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.46.240, located in California. Despite its recent creation, the domain has already been flagged by one security blocklist, though it remains undetected by antivirus engines, with a VirusTotal score of 0/95. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites, which does not inherently validate the domain's trustworthiness. The use of Cloudflare's infrastructure further complicates attribution, as it masks the true origin of the hosting server. Users who have visited trezurr-wallet-clasic.pages.dev or entered any sensitive information on the site should immediately cease all interaction and take corrective actions. This includes revoking any active sessions, rotating passwords or seed phrases associated with cryptocurrency wallets, and monitoring accounts for unauthorized transactions. If cryptocurrency was transferred to an address provided by the site, victims should report the incident to relevant blockchain analysis platforms and law enforcement agencies. Additionally, affected users are advised to scan their devices for malware, as credential theft sites often deploy additional payloads to maintain persistence or exfiltrate further data.