en-us-trezrwa[.]pages[.]dev

The domain en-us-trezrwa.pages.dev has been identified as a confirmed brand impersonation site targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics Trezor's official interface, presenting a page titled 'Trezor Wallet® | The Original & Most Trusted,' which aligns with known phishing tactics designed to deceive users into divulging sensitive credentials or installing malicious software. The domain is currently offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered on June 15, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. Despite its malicious intent, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating a low detection rate at the time of assessment. However, it appears on three security blocklists and has been actively blocked by MetaMask, PhishDestroy, and SEAL. The site employs HTTP/3 and HSTS, with an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. Gridinsoft's trust score for the domain is 0/100, further corroborating its malicious classification. Given the domain's current offline status, immediate threat mitigation measures are no longer required. However, organizations and individuals should remain vigilant, as similar domains may resurface. It is recommended to monitor for newly registered domains impersonating cryptocurrency brands, particularly those leveraging Cloudflare infrastructure. Network-level blocking of the IP address 188.114.96.3 and associated domains is advised. Users should verify the authenticity of cryptocurrency-related websites by cross-referencing official sources and employing browser-based security extensions that detect phishing attempts. Incident response teams should update blocklists to include this domain and its indicators of compromise for future reference.