sutetr-ez-or[.]pages[.]dev

PhishDestroy has identified an active brand impersonation domain targeting Trezor users. The domain sutetr-ez-or.pages.dev is currently under investigation for mimicking the official Trezor wallet interface to harvest user credentials and cryptocurrency funds. Security researchers have confirmed this is a high-fidelity phishing page designed to deceive visitors into entering sensitive wallet recovery phrases or login credentials. The page leverages Cloudflare Pages hosting to maintain the appearance of legitimacy while distributing malicious content to unsuspecting victims. This domain was flagged with 0 detections out of 95 VirusTotal scans as of the latest analysis, indicating it has evaded automated detection mechanisms. The domain resolves to IP address 188.114.97.3 and operates with a Google Trust Services SSL certificate to further enhance its credibility. Registered through Cloudflare, Inc., this impersonation site demonstrates sophisticated operational security to avoid immediate blacklisting. While no current blocklist entries exist, the domain's recent creation and clean reputation score suggest it may be a newly deployed threat vector. Users who have visited this domain should immediately check their browser history and remove any saved credentials related to Trezor or cryptocurrency services. If any information was entered on the page, users must transfer their funds to a new wallet using official Trezor software or hardware devices. Enable two-factor authentication on all cryptocurrency accounts and report any suspicious transactions to Trezor support immediately. Consider installing browser extensions that block known phishing domains or using a hardware wallet for all cryptocurrency transactions to prevent future credential theft.