trezor-zero[.]pages[.]dev

This domain, trezor-zero.pages.dev, poses a high-risk brand impersonation threat targeting users of Trezor hardware wallets. Analysis indicates the site mimics legitimate Trezor design documentation, potentially luring victims into entering sensitive credentials or downloading malicious software under the guise of official wallet support. The domain specifically replicates the visual and structural elements of Trezor’s interface, increasing the likelihood of deception for users seeking genuine wallet setup or troubleshooting guidance. Infrastructure analysis reveals multiple concrete indicators of malicious intent. The domain was registered on February 18, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). Security vendors on VirusTotal flag the domain as malicious, with 8 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist, further corroborating its fraudulent nature. The SSL certificate (E8) does not align with Trezor’s official certificate authority, providing another discrepancy for verification. Users who have visited trezor-zero.pages.dev should immediately cease all interaction with the site. Any credentials or recovery phrases entered on the domain should be considered compromised and revoked. Affected individuals are advised to conduct a full security audit of their devices, including scanning for malware and reviewing connected wallet transactions for unauthorized activity. Official support channels should be used to verify the legitimacy of any communications or software related to hardware wallets. Given the domain’s active status and high-risk classification, heightened vigilance is recommended for all interactions involving cryptocurrency infrastructure.