trezor-suite-download-get[.]pages[.]dev

The domain trezor-suite-download-get.pages.dev has been flagged by 17 out of 95 vendors on VirusTotal as malicious, indicating a significant threat level. This domain impersonates Trezor, a well-known cryptocurrency hardware wallet provider, aiming to deceive users into downloading malicious software under the guise of legitimate Trezor suite downloads. The site has been taken down and is currently offline, reducing immediate risk.

Registered through Cloudflare, Inc., this domain was created on October 28, 2025, and detected by PhishDestroy on February 26, 2026. The domain's hosting IP, located in the United States and managed by Cloudflare, Inc., further underscores the sophisticated infrastructure often utilized in such scams. Despite its offline status, the domain's previous activity highlights the persistent threat posed by similar phishing operations.

The platform risk score for this domain is notably high at 93/100, reflecting the potential impact and reach of the scam. Additionally, the domain appears on two public blocklists, including PhishDestroy and PhishingDB, emphasizing the broader recognition of its malicious intent. The SSL certificate issued by Google Trust Services suggests an attempt to appear legitimate, a common tactic in phishing schemes targeting cryptocurrency users. This case illustrates the ongoing challenges in combating phishing threats, particularly those exploiting trusted brands like Trezor.