trezorlogin[.]pages[.]dev

Analysis of trezorlogin.pages.dev shows the domain was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 188.114.96.3 (ASN13335, United States). The site presented the page title “Suspected phishing site | Cloudflare” and returns HTTP 403, indicating the content is currently inaccessible. TLS termination is provided by a Google Trust Services / WE1 certificate, and the server advertises HSTS, HTTP/3 and Cloudflare‑specific headers, confirming the use of Cloudflare’s edge network. The domain is classified as a brand‑impersonation campaign targeting the Trezor hardware‑wallet brand and is tagged as a crypto‑related scam.

Nine of ninety‑three VirusTotal scanners flagged the host, and a Gridinsoft trust score of 0 / 100 reflects a high confidence of malicious intent. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask and SEAL. Nameservers listed as malavika.ns.cloudflare.com and jeff.ns.cloudflare.com are typical of Cloudflare‑managed domains. Current evidence confirms the infrastructure, registration and threat indicators, but no content snapshot is available because the site is offline and returns a 403 response.

Consequently, the exact phishing page layout, credential‑capture mechanisms or malicious payloads cannot be verified at this time. Defenders should continue to block the domain at network and DNS layers, monitor the IP address for any re‑use, and add the host to internal allow‑lists of malicious URLs. Threat‑intel feeds that reference the domain or its associated IP should be updated, and users of Trezor services should be warned about unsolicited login requests that reference “trezorlogin.pages.dev”. Ongoing observation of Cloudflare‑edge IP ranges for similar newly registered domains is recommended.