hardware--en-io-trezo-desk[.]pages[.]dev

This domain, hardware--en-io-trezo-desk.pages.dev, is flagged for brand impersonation targeting Trezor, a leading cryptocurrency hardware wallet provider. Analysis indicates the site mimics the official Trezor login interface, presenting a page titled 'Trezor Wallet Secure Login' to deceive users into entering sensitive credentials or recovery phrases. Such impersonation schemes are commonly used to facilitate crypto drainer attacks, where victims unknowingly authorize transactions or disclose private keys, leading to irreversible asset theft. The threat is particularly insidious given the irreversible nature of blockchain transactions and the high-value targets associated with hardware wallet users. Infrastructure analysis reveals concrete indicators of malicious intent. The domain resolves to IP address 172.66.44.73 and is registered through Cloudflare, Inc., with a creation date of April 18, 2026—an anomalous timestamp suggesting potential domain spoofing or backdating. Despite its deceptive appearance, the domain has not yet been widely flagged, with VirusTotal reporting 0 detections out of 95 security engines. However, it appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The site employs HSTS, Cloudflare CDN, and HTTP/3, leveraging legitimate infrastructure to evade detection. The SSL certificate is issued by Google Trust Services, further masking its malicious nature behind trusted encryption standards. Users who visited hardware--en-io-trezo-desk.pages.dev should assume their credentials or recovery phrases may have been compromised. Immediate action is required: revoke any active sessions or authorized applications linked to Trezor accounts, generate new recovery phrases, and transfer assets to a new wallet with a fresh seed. Monitor transaction histories for unauthorized activity and enable multi-factor authentication where available. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts, particularly those leveraging Cloudflare-hosted subdomains or mimicking hardware wallet login pages. Security teams are advised to block the IP 172.66.44.73 and monitor for related infrastructure, as threat actors often reuse hosting providers for subsequent campaigns.