io-trezeer-strt-learn-suites[.]pages[.]dev

Impersonating Ethereum and Trezor, io-trezeer-strt-learn-suites.pages.dev is a phishing domain designed to steal cryptocurrency wallet seeds. Despite being offline now, it was flagged by 9 out of 93 vendors on VirusTotal, indicating its malicious nature. Public blocklists from PhishDestroy, MetaMask, and SEAL also recognize the threat.

The domain masquerades as a legitimate Trezor Suite download page, attempting to deceive users into entering sensitive information. This scam leverages both seed phishing and tech support scam tactics, exploiting the trust users place in the Ethereum and Trezor brands. The domain's SSL certificate issued by Google Trust Services might have lent it an air of legitimacy to unsuspecting visitors.

Hosted by Cloudflare, Inc. in the United States, the domain's infrastructure suggests a sophisticated setup aimed at maximizing reach and impact. With a platform risk score of 75/100, the threat level is significant, though the domain's current offline status mitigates immediate risk. The creation date of September 2020 and detection by PhishDestroy in December 2025 highlight a long-standing operation, possibly resurfacing periodically to target new victims. This case underscores the importance of proactive threat detection and swift takedown efforts.