trezorio-strt[.]pages[.]dev

Analysis of trezorio-strt.pages.dev indicates a confirmed phishing infrastructure targeting Trezor, a cryptocurrency hardware wallet provider. The domain, registered on February 21, 2026, through Cloudflare, Inc., was flagged by 11 of 93 security vendors on VirusTotal, though no further details on specific detection rules are available. It appears on a single security blocklist (PhishDestroy) under the classification of a crypto scam, aligning with the documented threat type of brand impersonation. Infrastructure analysis reveals the domain resolves to 172.66.44.195, hosted on Cloudflare's network (AS13335) in the United States, with nameservers dora.ns.cloudflare.com and trevor.ns.cloudflare.com.

The SSL certificate, issued by Google Trust Services (WE1), and detected technologies including HSTS and HTTP/3, suggest an attempt to mimic legitimate security practices. As of July 25, 2026, the domain returns an HTTP 403 status with the page title 'Suspected phishing site | Cloudflare,' indicating it has been taken offline or restricted by the hosting provider. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious classification.

While the exact content of the phishing page remains unanalyzed, the available evidence—including the domain name, brand target, and scam type—strongly supports its use in a cryptocurrency-related fraud scheme. Defenders should treat this domain as compromised infrastructure and block it at the network level. Further monitoring of associated IPs and certificates is recommended to identify related threats.