trezorlogin-ean[.]pages[.]dev

The domain trezorlogin-ean.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is presently taken offline, returning an HTTP 403 response. The site is fronted by Cloudflare’s edge network (IP 172.66.47.147, AS13335, United States) and presents a valid SSL certificate issued by Google Trust Services under the WE1 root, indicating proper TLS termination. The page title returned by the server is "Suspected phishing site | Cloudflare," which is a generic Cloudflare block page rather than a bespoke landing page. According to the supplied intelligence, the domain is classified as a crypto‑related scam that impersonates the Trezor hardware‑wallet brand.

It appears on one security blocklist and has been specifically blocked by PhishDestroy. Ten of ninety‑three VirusTotal scanners flagged the domain, and independent reputation services assign a Scamadviser score of 41 / 100 and a Gridinsoft score of 0 / 100, reflecting a high likelihood of malicious intent. Detected technologies include HTTP/3, HSTS enforcement, and Cloudflare’s CDN services, all of which are typical for malicious actors seeking to obscure origin and improve availability. The primary uncertainties are the exact payload or credential‑harvesting mechanism, as the content behind the Cloudflare block page has not been captured, and the presence of any additional infrastructure (command‑and‑control, payment gateways, or cryptocurrency addresses) remains unknown.

Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the domain and its associated IP, and monitor for any future re‑registration or similar sub‑domains leveraging the "trezorlogin" prefix. Threat‑hunters should query VirusTotal and other sandbox services for any archived samples, and incident responders should advise users of Trezor to disregard any unsolicited login requests originating from this or similarly crafted domains.