app-treezor-suit-e-io[.]pages[.]dev

This domain, app-treezor-suit-e-io.pages.dev, is identified as a credential theft operation targeting cryptocurrency users through brand impersonation of Trezor Suite. The page title, 'Trĕzôr Suite | Ultimate Digital Asset Management,' uses Unicode character substitution (ĕ) to evade basic detection while mimicking the legitimate hardware wallet interface. No specific drainer kit signatures were observed, but the domain's structure and content align with credential harvesting tactics used in crypto wallet compromise campaigns. Analysis indicates the domain was registered through Cloudflare, Inc., resolving to IP address 188.114.97.3. Security vendors on VirusTotal flagged this domain at a 4/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on three security blocklists and was actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. No creation date was publicly available, but infrastructure analysis reveals Cloudflare Pages hosting, a common vector for rapidly deployed phishing sites. The domain is currently offline, likely taken down following detection by security vendors and blocklist providers. However, the infrastructure remains a residual risk, as threat actors may redeploy similar domains using the same registrar and hosting patterns. Users who interacted with this domain should assume credential exposure and immediately rotate wallet keys, enable multi-factor authentication, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP address to prevent future access attempts.