guided-trezor[.]pages[.]dev

PhishDestroy identifies guided-trezor.pages.dev as an active brand impersonation domain targeting Trezor cryptocurrency wallet users. The site leverages Cloudflare Pages infrastructure to deploy a fraudulent interface designed to deceive visitors into believing they are interacting with an official Trezor service. Current threat intelligence confirms ongoing malicious activity with no signs of takedown as of seed 38bd58. This domain was flagged by 11 of 95 VirusTotal vendors at time of analysis, indicating a currently undetected threat. It resolves to IP address 188.114.97.3 via Cloudflare, Inc., a hosting provider frequently abused for masking malicious infrastructure. The domain employs a Google Trust Services SSL certificate to enhance authenticity, while Cloudflare’s infrastructure obscures the true origin of the servers. The Trezor brand is specifically targeted in this campaign, with the malicious domain presenting as a guided setup or support page for Trezor hardware wallets. While the immediate detection rate on VirusTotal remains at 0%, the presence of a Google-issued SSL certificate combined with brand impersonation tactics significantly increases the risk of credential theft or cryptocurrency drainer deployment. Given the active status of this domain and the sophistication of the impersonation, users should avoid all interactions with guided-trezor.pages.dev. Security teams are advised to block the domain at the network level and monitor for related infrastructure. For Trezor users, always verify access points via the official trezor.io domain and enable hardware wallet verification features to prevent unauthorized transactions.