trezorwallet-device[.]pages[.]dev

This report details a phishing threat targeting users of the Trezor cryptocurrency brand. The site, hosted at trezorwallet-device.pages.dev, displayed a page title of "Suspected phishing site | Cloudflare" and was identified as a cryptocurrency scam that impersonates the Trezor brand. The primary threat posed by this site was the theft of cryptocurrency wallet credentials or seed phrases from users believing they were interacting with a legitimate Trezor service.

Technical analysis confirms the malicious nature of this domain. VirusTotal data shows 6 out of 95 security vendors flagged the site as malicious, with specific detections from BitDefender, CyRadar, Fortinet, G-Data, and Kaspersky. The domain is registered with Cloudflare, Inc. and was created on 2025-09-09. The site resolves to IP address 188.114.97.3 located in the United States, hosted on AS13335 (Cloudflare, Inc.). Its SSL certificate was issued by Google Trust Services / WE1, and its nameservers are serena.ns.cloudflare.com and stan.ns.cloudflare.com.

As of the time of analysis, the site is currently DOWN or OFFLINE. Despite its inactive status, the risk level remains high. The GridinSoft trust score is 0 out of 100, ScamAdviser trust is 41 out of 100, and the DOM risk score is 83 out of 100, indicating a very high probability of malicious intent. Users who may have interacted with this site while it was active are advised to secure their Trezor wallets immediately.