treizor-io-un[.]pages[.]dev

This domain operates as a brand impersonation threat targeting users of Trezor cryptocurrency hardware wallets. Analysis indicates the site presents itself as the official Trezor Suite application, using the page title 'Trezor Suite App — Secure & Modern Crypto Management' to deceive visitors into downloading malicious wallet software or entering sensitive recovery phrases. The infrastructure mimics legitimate wallet management interfaces, creating a false sense of security for cryptocurrency holders seeking to manage their assets. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain treizor-io-un.pages.dev was registered through Cloudflare, Inc. on April 09, 2026, resolving to IP address 188.114.97.3 located in Canada. Security validation shows 7 out of 95 engines on VirusTotal flagging the domain as malicious, while PhishDestroy has added it to their blocklist. The site uses a Google Trust Services SSL certificate (WE1) to appear legitimate, though this certificate authority is commonly exploited by threat actors to lend credibility to phishing infrastructure. Only one security blocklist currently tracks this domain, suggesting it may still be in early deployment stages. Users who visited treizor-io-un.pages.dev should immediately revoke any wallet access permissions and consider all credentials entered on the site compromised. Cryptocurrency holders should verify wallet software only through official distribution channels, checking for proper domain structure (trezor.io) and SSL certificate details. Any funds managed through software obtained from this domain should be transferred to new wallets created with verified legitimate software. System scans for malware are recommended, as the site may have distributed payloads beyond credential harvesting. The domain remains active as of analysis, requiring continued monitoring for additional security vendor detections.