tre-zor-suite-us[.]pages[.]dev

The domain tre-zor-suite-us.pages.dev is currently active and operates as a brand impersonation phishing site targeting Trezor, a hardware cryptocurrency wallet provider. Analysis confirms the domain mimics legitimate Trezor wallet setup pages, specifically the Trezor Model T, to deceive users into submitting sensitive credentials or recovery seeds. The page title, 'Setup Trezor Model T: Secure Your Crypto Wallet,' directly aligns with Trezor’s official onboarding process, increasing the likelihood of successful social engineering attacks.

Technical indicators reveal the domain is flagged by 2 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on 3 security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.2. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site’s content. No historical registration data is publicly available, limiting further infrastructure analysis.

The domain remains active as of this report, posing a high risk to users attempting to set up or recover Trezor hardware wallets. Recommended actions include immediate blacklisting of the domain and IP across all security gateways, dissemination of indicators of compromise (IOCs) to threat intelligence platforms, and user education on verifying official Trezor domains (e.g., trezor.io). Users who may have interacted with this domain should revoke any exposed credentials, monitor for unauthorized transactions, and reinitialize hardware wallets using official channels.