old-start-trezr-en[.]pages[.]dev

This domain, old-start-trezr-en.pages.dev, is flagged as an active credential phishing site targeting Trezor, a cryptocurrency hardware wallet brand. Registered on April 18, 2026, through Cloudflare, Inc., the domain resolves to IP 172.66.47.16, hosted in Canada under Cloudflare's infrastructure. Analysis of its page title, 'Trezor @Login – The Official Wallet | Trezor®,' confirms brand impersonation, aligning with the reported scam type of credential phishing. The domain is currently active, returning an HTTP 403 status, which may indicate restricted access or evasion tactics. It appears on one security blocklist, though no detections were recorded among 94 vendors in a recent scan. Infrastructure details include Cloudflare nameservers (andy.ns.cloudflare.com, aurora.ns.cloudflare.com), an SSL certificate issued by Google Trust Services (WE1), and technologies such as HSTS and HTTP/3. Defenders should treat this domain as high-risk due to its confirmed impersonation of a cryptocurrency service and active status. Monitoring for changes in HTTP status, additional blocklist inclusions, or shifts in hosting behavior is recommended. The absence of vendor detections does not confirm safety, and further analysis of the site's content—if accessible—is advised to determine the full scope of the phishing operation.