wallet-trezoor-io-hard-ware[.]pages[.]dev

This domain, wallet-trezoor-io-hard-ware.pages.dev, is identified as a brand impersonation threat targeting Trezor, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into entering sensitive wallet credentials or recovery phrases by mimicking Trezor’s official interface. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential theft campaigns targeting cryptocurrency users. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on October 31, 2025, and resolves to IP address 172.66.46.226, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). The domain is flagged by 15 out of 95 security vendors on VirusTotal and appears on two security blocklists: PhishDestroy and PhishingDB. The page title, 'Suspected phishing site | Cloudflare,' suggests automated detection triggered protective measures. The domain has been taken offline, reducing immediate risk to users. However, residual threats remain, including potential reuse of the infrastructure or migration of the campaign to new domains. Users who interacted with the site should revoke any active sessions, rotate credentials, and monitor wallet activity for unauthorized transactions. Security teams are advised to block the domain, IP, and associated indicators across network defenses to prevent future access attempts.