treazor-suite-en[.]pages[.]dev

PhishDestroy identifies an active phishing campaign targeting cryptocurrency users through treazor-suite-en.pages.dev, a fraudulent Trezor Suite web portal designed to steal wallet credentials and seed phrases. This domain mimics the legitimate Trezor Suite interface (suite.trezor.com) to deceive victims into entering sensitive recovery phrases or private keys, enabling attackers to drain cryptocurrency holdings. The threat actor leverages Cloudflare Pages for hosting, obscuring the true infrastructure behind Cloudflare's proxy network (IP 172.66.47.201). SSL certificates issued by Google Trust Services further enhance the domain's appearance of legitimacy, increasing the likelihood of successful deception. As of investigation seed 29fb71, this domain remains undetected by 95 security vendors on VirusTotal, highlighting the sophistication of the campaign's evasion tactics.

Technical analysis reveals this domain was flagged as a high-priority threat under investigation, with no prior blocklist entries at the time of discovery. The domain resolves via Cloudflare, Inc., a common tactic among phishing operators to obfuscate hosting origins, and is part of a larger cluster of Trezor-themed phishing domains observed in Q3 2024. The use of Google Trust Services for SSL certificates suggests an attempt to exploit trusted Certificate Authorities to bypass browser security warnings. Comparing this to known cryptocurrency phishing campaigns, this domain exhibits characteristics typical of credential harvesting attacks targeting users of hardware wallet ecosystems, with a focus on mimicking official suite interfaces.

Users who visited treazor-suite-en.pages.dev should immediately assume compromise. Disconnect any devices used to access the site, revoke permissions for connected apps, and transfer remaining funds to a newly generated wallet on a verified Trezor device or alternative secure platform. Do not reuse recovery phrases or passwords entered on this domain. Report the domain to your email provider, browser, and Trezor’s official support channels to aid in takedown efforts. Monitor accounts for unauthorized transactions and consider enabling multi-factor authentication on all cryptocurrency-related services. If seed phrases or private keys were entered, assume all associated funds are at risk and take immediate action to limit damage.