trez-suitee[.]pages[.]dev

PhishDestroy’s threat intelligence team has flagged trez-suitee.pages.dev as an active crypto drainer phishing domain under investigation. This domain mimics legitimate cryptocurrency tools—specifically targeting users by impersonating the Trezor Suite interface to siphon funds from unsuspecting victims. Upon analysis, the domain was found to resolve to IP address 188.114.97.3, a Cloudflare-hosted endpoint leveraging a Google Trust Services SSL certificate to appear legitimate. Notably, despite hosting malicious infrastructure, the domain has not yet been flagged by VirusTotal, registering 0 detections out of 95 scanners as of the latest scan. This low detection rate suggests either evasion tactics or a recent deployment, warranting immediate attention from security teams and users alike. The domain was registered through Cloudflare, Inc., a common choice for threat actors seeking anonymity and rapid deployment. While the exact creation date is not disclosed in available records, the lack of detections and active SSL certificate implies a recent go-live, likely within the last 30 days. Given its infrastructure alignment with known crypto drainer campaigns, the risk level is currently classified as active and under investigation, with potential for escalation as threat intelligence evolves. The absence of blocklist entries further underscores the urgency for proactive blocking, as traditional security controls may not yet recognize the threat. Users who have accessed trez-suitee.pages.dev should immediately cease any interaction with the site and revoke any permissions granted to cryptocurrency wallets or extensions linked to this domain. Conduct a full audit of wallet extensions, browser profiles, and transaction histories for signs of unauthorized transfers. If any funds have been drained, report the incident to local cybercrime units and the platform’s fraud team with screenshots and transaction IDs. To mitigate future exposure, block the domain and IP address 188.114.97.3 at the network perimeter, and update endpoint detection rules to flag similar Cloudflare-hosted crypto drainer campaigns. For ongoing monitoring, enable transaction alerts on all cryptocurrency accounts and avoid interacting with unsolicited links claiming to offer Trezor Suite services.