treiizor-io-un[.]pages[.]dev

treiizor-io-un.pages.dev has been identified by PhishDestroy as an active credential-harvesting domain impersonating Trezor cryptocurrency wallets. The page uses a deceptive login interface to trick users into entering private wallet recovery phrases or seed phrases, which are then transmitted to attacker-controlled servers. This domain is currently under active investigation and remains unresolved, with no confirmed takedown as of the latest assessment cycle. Users attempting to access this domain are at immediate risk of financial loss and account compromise.

This domain was flagged by 8 out of 95 VirusTotal security vendors, indicating a low detection rate despite clear malicious intent. The site is registered through Cloudflare, Inc., resolving to IP address 188.114.97.3 via Google Trust Services SSL certificate. The domain employs Cloudflare Pages hosting and was created recently, though the exact registration date is not disclosed in public WHOIS records. It remains unlisted on major blocklists including Google Safe Browsing, PhishTank, and OpenPhish at the time of evaluation. Trust scores are critically low, with no reputation established across threat intelligence platforms.

The domain remains active and poses a high risk to cryptocurrency users seeking wallet access. PhishDestroy recommends blocking the domain at the network level and avoiding all links referencing treiizor-io-un.pages.dev. Users who have entered credentials on this page should immediately transfer funds to a new wallet, revoke any exposed recovery phrases, and monitor for unauthorized transactions. Report the domain to Trezor support and relevant abuse channels (e.g., Cloudflare Abuse, Google Trust Services). Enable multi-factor authentication and verify wallet URLs using official Trezor domains only.