trezor-suite-wallet[.]pages[.]dev

This domain, trezor-suite-wallet.pages.dev, was observed impersonating Trezor, a hardware cryptocurrency wallet provider, with the intent to harvest user credentials and private keys. The site employed brand impersonation techniques to deceive visitors into entering sensitive wallet recovery phrases or login details, which could lead to unauthorized access and asset theft. Analysis indicates the domain targeted users seeking legitimate Trezor wallet software or support, exploiting trust in the brand to facilitate fraudulent activity. Infrastructure analysis reveals the domain was registered on September 09, 2025, through Cloudflare, Inc., and resolved to the IP address 172.66.44.116, hosted on Cloudflare’s network (AS13335). The SSL certificate was issued by Google Trust Services (WE1), a common characteristic of Cloudflare-managed domains. At the time of detection, the domain appeared on one security blocklist and was flagged by 9 out of 95 security vendors on VirusTotal, indicating a consensus among detection engines regarding its malicious nature. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider had already identified and mitigated the threat, though the domain remained accessible during the investigation. Users who visited trezor-suite-wallet.pages.dev or entered credentials on the site should assume compromise of any sensitive information shared. Immediate actions include revoking access to associated cryptocurrency wallets, generating new recovery phrases, and monitoring accounts for unauthorized transactions. Affected devices should be scanned for malware, as credential harvesting sites may deploy additional payloads. Users are advised to verify domain authenticity by cross-referencing official sources and employing hardware-based multi-factor authentication for wallet access. If financial loss occurred, reporting to relevant authorities and blockchain analytics services is recommended to trace or freeze stolen assets.