app-suits-trez[.]pages[.]dev

The domain app-suits-trez.pages.dev has been identified as a confirmed brand impersonation phishing site targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to mimic the official Trezor Suite interface, likely to harvest credentials or distribute malicious payloads under the guise of a legitimate crypto management application. The page title, 'Trezor Suite | Secure Crypto Management App — Presentation,' reinforces the deception by closely mirroring the branding of the authentic service. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for historical exposure. Technical indicators confirm the malicious nature of this domain. VirusTotal analysis reveals that 6 of 95 security vendors flagged app-suits-trez.pages.dev as malicious, while Gridinsoft assigned a trust score of 0 out of 100. The domain resolves to the IP address 172.66.47.131 and appears on one security blocklist. Infrastructure analysis shows the domain was registered on April 4, 2026, through Cloudflare, Inc., and utilized an SSL certificate issued by Google Trust Services. The use of Cloudflare infrastructure is consistent with threat actor tactics to obfuscate hosting origins and evade detection. Current status indicates the domain has been rendered inactive, though residual risk persists for users who may have interacted with it during its operational window. Organizations and individuals are advised to block the domain and its associated IP (172.66.47.131) at the network perimeter. Users who accessed the site should assume potential credential exposure and initiate password resets for any accounts linked to Trezor or related crypto services. Monitoring for anomalous login attempts or unauthorized transactions is strongly recommended. Security teams should review logs for connections to the domain or IP to identify compromised endpoints and conduct remediation as necessary.