trezr-hardwae-wall[.]pages[.]dev

PhishDestroy identifies trezr-hardwae-wall.pages.dev as an active phishing domain masquerading as an official Trezor hardware wallet support or sales portal. The domain leverages a spoofed interface to harvest user credentials and cryptocurrency wallet seeds, posing a direct financial threat to cryptocurrency holders seeking genuine Trezor products or support. Current telemetry confirms the domain is operational and has not yet been neutralized by the security community.

This domain was flagged by 2 of 95 VirusTotal vendors at the time of analysis, indicating a low initial detection rate despite its malicious intent. It resolves to IP address 172.66.44.141, is registered through Cloudflare, Inc., and operates with a Google Trust Services SSL certificate—exploiting legitimate infrastructure to appear credible. The unique seed identifier 2c0cfe correlates with this campaign, suggesting a targeted or automated phishing operation against cryptocurrency users.

Given the active status and undetected state, immediate defensive action is required. Organizations and end users should block traffic to trezr-hardwae-wall.pages.dev and 172.66.44.141 at the network perimeter and DNS level. Users should verify all cryptocurrency-related websites via official Trezor channels (trezor.io) and avoid clicking links in unsolicited emails or ads. Security teams are advised to monitor for related domains and update threat intelligence feeds with this IOC. This advisory will be updated as new intelligence emerges.