suite-trezoor-eng-us[.]pages[.]dev

PhishDestroy identifies suite-trezoor-eng-us.pages.dev as a fake Trezor-branded wallet phishing domain leveraging Google Pages to impersonate the legitimate Trezor cryptocurrency wallet interface. This domain employs a deceptive lookalike naming convention (suite-trezoor-eng-us) and hosts a fraudulent web page designed to trick users into entering their wallet recovery phrases or private keys, thereby granting threat actors full control over victim funds. No advanced drainer kit signatures were observed in sandbox analysis, suggesting the operators are relying on social engineering rather than sophisticated malware execution. The phishing lure specifically targets English-speaking Trezor users and presents a spoofed wallet authentication portal to harvest credentials and seed phrases.

This domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc., using Google Trust Services for its SSL certificate. As of current scanning, VirusTotal reports 0 detections out of 95 engines, indicating it remains undetected by most antivirus and web filtering platforms. The domain was flagged under investigative status with seed 09129a, and Google Safe Browsing (GSB) has not yet listed it, while the blocklist count remains at zero. These indicators suggest either recent deployment or low-profile targeting. The domain appears to have been recently created, though exact registration date is not publicly disclosed.

PhishDestroy currently labels this domain as ACTIVE with RISK LEVEL: UNDER_INVESTIGATION. While the site is operational and serving phishing content at the time of assessment, no automated detection signatures are yet widely available. Cloudflare’s proxying of the domain may delay takedown efforts. Users are strongly advised to avoid visiting suite-trezoor-eng-us.pages.dev and report it immediately via browser safety tools or phishing reporting channels. The remaining risk is moderate to high due to the potential for credential harvesting and cryptocurrency theft, especially if the domain continues to evade detection systems. Always verify URLs using official Trezor channels and enable hardware wallet security features before entering sensitive information.