secur-treoo-en-us[.]pages[.]dev

This domain, secur-treoo-en-us.pages.dev, operates as a fraudulent replica of the Trezor cryptocurrency wallet interface, designed to deceive users into entering sensitive credentials or recovery phrases. The site presents itself as "Trezor Suite - Secure Cryptocurrency Management," mimicking the legitimate Trezor Suite application to exploit user trust in the brand. Analysis indicates the domain was likely engineered to facilitate cryptocurrency theft, potentially functioning as a crypto drainer by harvesting private keys or seed phrases under false pretenses. The threat primarily targets individuals familiar with Trezor products, leveraging brand recognition to lower user vigilance during interactions with the site.

Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain was registered through Cloudflare, Inc. on October 31, 2025, and resolves to the IP address 172.66.44.241. Security vendor detections on VirusTotal show 10 out of 95 engines flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Detected technologies include HSTS, Cloudflare hosting, and HTTP/3, with an SSL certificate issued by Google Trust Services. The combination of brand impersonation, recent registration, and low trust scores underscores the elevated risk posed by this infrastructure.

Users who visited secur-treoo-en-us.pages.dev should assume potential exposure of sensitive credentials or cryptocurrency-related information. Immediate actions include revoking access to any connected wallets, generating new wallet addresses, and monitoring all linked accounts for unauthorized transactions. If recovery phrases or private keys were entered on the site, users must transfer remaining assets to a new, secure wallet immediately, as compromised keys enable full account control by attackers. Additionally, affected individuals should review their systems for malware, as phishing sites may distribute additional payloads. Reporting the incident to relevant security teams and cryptocurrency platforms can aid in mitigating further abuse of the stolen data.