en-trezosuit-io[.]pages[.]dev

PhishDestroy identifies en-trezosuit-io.pages.dev as an active crypto drainer site impersonating the Trezor hardware wallet brand, leveraging a fake Trezor-branded interface to trick users into connecting their wallets and signing malicious transactions that drain crypto assets. The domain is part of a broader pattern of crypto-specific phishing campaigns targeting hardware wallet users through lookalike pages hosted on trusted subdomains like pages.dev, exploiting trust in official domains to bypass user skepticism. Technical analysis reveals this is not a generic phishing page but a focused crypto drainer kit designed for maximum financial damage, with clear intent to steal user funds through wallet connection and transaction signing deception.

This domain resolves to IP 172.66.44.111 and is registered through Cloudflare, Inc., using a Google Trust Services SSL certificate to establish legitimacy. VirusTotal currently shows 1/95 detection engines flagging the domain, indicating it remains under the radar of most security vendors despite active malicious activity. The domain’s hosting on Cloudflare Pages (pages.dev) combined with a legitimate SSL certificate creates a sophisticated deception profile that can bypass traditional security measures, making it particularly dangerous for cryptocurrency users who may not verify URLs thoroughly before interacting with wallet connection interfaces.

The domain remains active at the time of analysis with no apparent takedown actions taken against it. PhishDestroy has flagged this domain as part of an ongoing investigation into crypto drainer operations targeting hardware wallet users. While the immediate risk is high for users who access this domain, the broader risk to the cryptocurrency community remains elevated as similar drainer kits continue to evolve and deploy across various trusted hosting platforms. Users should treat any Trezor-branded pages hosted on non-official domains with extreme caution and verify all wallet connections through official Trezor channels before proceeding with any transactions.