un-treezor-io[.]pages[.]dev

This domain, un-treezor-io.pages.dev, is flagged as an active brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site presents itself as the legitimate Trezor Suite App under the page title 'Trezor Suite App: Secure Cryptocurrency Management,' designed to deceive users into entering sensitive credentials or wallet recovery phrases. No drainer kit signatures have been identified yet, but the infrastructure aligns with known phishing patterns for cryptocurrency theft. Infrastructure analysis reveals the domain was registered on April 1, 2026, through Cloudflare Pages and resolves to the IP address 172.66.44.150, hosted by Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious sites leveraging legitimate CDN infrastructure. VirusTotal reports zero detections out of 95 engines, indicating the site has not yet been widely flagged. However, it appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing status is not explicitly listed, but the domain's active impersonation of a trusted brand warrants caution. The domain remains active as of this report, posing a continued risk to users who may mistake it for the legitimate Trezor platform. Response actions should include immediate blacklisting, DNS sinkholing, and monitoring for credential harvesting or wallet-draining activity. Despite the low detection rate, the combination of brand impersonation, recent registration, and Cloudflare-hosted infrastructure confirms malicious intent. Users are advised to verify domain authenticity via official sources and avoid interacting with any unsolicited cryptocurrency management pages.