wallet-trezoru[.]pages[.]dev

Wallet-trezoru.pages.dev is a domain that impersonates the cryptocurrency brand Trezor, aiming to deceive users into compromising their digital wallets. This domain has been flagged as malicious by 18 out of 93 vendors on VirusTotal, indicating a significant level of threat. Despite its current offline status, it was operational long enough to attract attention and be listed on one public blocklist, specifically by PhishDestroy.

The domain was registered through Cloudflare, Inc. and hosted on an IP address associated with Cloudflare in the United States. The SSL certificate was issued by Google Trust Services, further adding a layer of perceived legitimacy that could mislead potential victims. The platform risk score for this domain is notably high at 93 out of 100, reflecting the potential danger it posed during its active period.

PhishDestroy identified this domain on February 26, 2026, just five days after its creation. This quick detection highlights the efficiency of PhishDestroy's monitoring systems in identifying phishing threats early, even before they are widely recognized by antivirus vendors. The domain's rapid takedown suggests a swift response from hosting services, yet the initial exposure period could have been enough to compromise unsuspecting users.

The use of a trusted brand like Trezor in the domain name is a classic tactic in phishing schemes, designed to exploit the trust users have in established cryptocurrency services. This case underscores the importance of vigilance and the need for robust security measures to protect against such deceptive practices.