brij-trezor[.]pages[.]dev

The domain brij-trezor.pages.dev is a confirmed phishing site that engaged in brand impersonation of Trezor, a cryptocurrency hardware wallet company, to trick users into revealing sensitive information. This specific threat is a cryptocurrency scam designed to steal login credentials or seed phrases from Trezor users. The site is currently taken offline, but it posed an elevated risk due to its convincing impersonation and low trust scores.

Technical analysis shows that brij-trezor.pages.dev was flagged by 14 of 95 VirusTotal vendors, including ADMINUSLabs, Criminal IP, and alphaMountain.ai, while Google Safe Browsing did not flag it. The domain was registered through Cloudflare, Inc. on October 08, 2025, and resolves to IP address 188.114.96.3, located in the US with AS13335 Cloudflare. It appears on 2 security blocklists (PhishDestroy and PhishingDB) and has SSL issued by Google Trust Services / WE1. The page title observed was 'Suspected phishing site | Cloudflare', and the HTTP status was 403. Trust scores from Gridinsoft and Scamadviser were 0/100 and 1/100 respectively, indicating high risk.

Since brij-trezor.pages.dev is a cryptocurrency phishing site, users who may have interacted with it should immediately change any passwords entered on the page and enable two-factor authentication on their Trezor accounts and email. If any cryptocurrency wallet seed phrases were provided, move all funds to a new wallet and revoke any token approvals. Report the domain to PhishDestroy and PhishingDB, and to Trezor's security team, to help prevent future attacks.