app-tresors-suit[.]pages[.]dev

The domain app-tresors-suit.pages.dev has been identified as a brand impersonation threat specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. This domain is currently offline, having been taken down after its malicious nature was confirmed. It was created on September 24, 2025, and registered through Cloudflare, Inc., a common registrar for both legitimate and malicious sites. The page title observed was 'Suspected phishing site | Cloudflare', indicating that Cloudflare had already flagged it as suspicious.

According to intelligence gathered, this domain was flagged by 11 of 95 security vendors on VirusTotal, indicating a moderate but clear malicious consensus. It appears on one security blocklist and resolves to the IP address 172.66.44.172. The SSL certificate was issued by Google Trust Services, specifically a WE1 certificate, which is typical for sites using Cloudflare's proxy services. The domain's registration date and its association with a known brand make it a clear attempt to deceive users into believing they are interacting with a legitimate Trezor service, likely to steal cryptocurrency credentials or seed phrases.

Given that the domain is now offline, the immediate risk to users is reduced, but organizations and individuals should remain vigilant. PhishDestroy recommends blocking the domain app-tresors-suit.pages.dev at the network level and educating users about Trezor impersonation scams. Users should always verify URLs carefully, especially when prompted to enter sensitive information. As a general precaution, avoid clicking on unsolicited links and always navigate directly to official websites by typing the address manually.