trzor-suite--iio[.]pages[.]dev

This domain, trzor-suite--iio.pages.dev, presents a direct threat to users of Trezor hardware wallets by impersonating the official Trezor Suite application. The site displays a fraudulent page titled 'Trezor Suite 2025 — Secure Setup, Features,' designed to deceive visitors into entering sensitive wallet credentials, recovery seeds, or private keys. Such phishing attempts are commonly used to drain cryptocurrency assets from unsuspecting victims by capturing authentication details that grant attackers full access to digital wallets. The use of a convincing interface, combined with technical obfuscation tactics, increases the likelihood of successful exploitation, particularly among users unfamiliar with official domain structures or security best practices. Analysis indicates the domain was registered on March 25, 2026, through Cloudflare, Inc., a provider frequently leveraged by threat actors to mask infrastructure and evade detection. The domain resolves to the IP address 188.114.96.3, a Cloudflare-hosted endpoint, and employs HTTP/3 and HSTS protocols to mimic legitimate security practices. Despite these measures, security vendors have flagged the domain as malicious, with 11 out of 95 engines on VirusTotal detecting it as a phishing threat. Additionally, the domain appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft, further confirming its malicious intent. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as it is commonly used by both legitimate and fraudulent sites to establish encrypted connections. Users who visited trzor-suite--iio.pages.dev should assume their credentials or recovery phrases may have been compromised. Immediate action is required: disconnect any connected wallets from the internet, generate new wallet addresses, and transfer remaining assets to a secure, offline storage solution. If any sensitive information was entered on the site, consider the associated wallet compromised and cease all transactions from it. Monitor all linked accounts for unauthorized activity and enable multi-factor authentication where available. Report the incident to the official Trezor security team for further guidance, and avoid interacting with any domains or communications claiming to represent Trezor that do not originate from the verified trezor.io domain.