trezr--suite-en[.]pages[.]dev

PhishDestroy assesses the domain trezr--suite-en.pages.dev as a high-risk threat, specifically a brand impersonation attack targeting Trezor cryptocurrency wallet users. This fraudulent site masquerades as the legitimate Trezor Suite platform, aiming to steal sensitive wallet credentials and seed phrases from unsuspecting visitors. The risk level is elevated due to the active and ongoing nature of the campaign.

The technical analysis reveals several red flags. The domain was registered on April 3, 2026, through Cloudflare, Inc., and resolves to IP address 172.66.47.161. Despite using an SSL certificate from Google Trust Services (WE1), which creates a false sense of security, VirusTotal reports that 6 out of 95 security vendors flag the domain as malicious. It currently appears on one security blocklist, though its transient nature suggests it may evade broader detection. The domain name 'trezr--suite-en.pages.dev' is a clear typosquatting variant of the official Trezor domain, designed to trick users into believing they are on a legitimate site.

To protect against this specific threat, users should always verify the URL of any Trezor-related website before entering credentials. The official Trezor Suite is accessible only at 'suite.trezor.io'. Never download software or enter seed phrases from untrusted sources. Enable two-factor authentication on your cryptocurrency accounts and use hardware wallets for cold storage. If you have already interacted with this domain, immediately transfer your assets to a new wallet generated on a secure device and contact Trezor support for further guidance.