trzorsuite-iio[.]pages[.]dev

This domain, trzorsuite-iio.pages.dev, presents an elevated-risk brand impersonation threat targeting Trezor cryptocurrency wallet users. The page mimics the legitimate Trezor Suite interface under the title 'Trezor Suite 2025 — Secure Setup, Features,' designed to deceive users into entering sensitive wallet credentials, recovery seeds, or private keys. Analysis indicates the infrastructure is engineered to exploit trust in the Trezor brand, potentially leading to unauthorized access to digital assets and financial theft. The domain employs social engineering tactics to create a false sense of security, leveraging a professional appearance and technical safeguards to lower user vigilance.

Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain resolves to IP address 172.66.47.111 and is registered through Cloudflare, Inc., with a creation date of March 25, 2026, suggesting a recently established operation. It appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically marking it for 'SOCIAL_ENGINEERING.' The site employs HSTS, Cloudflare CDN, and HTTP/3, which are legitimate technologies but are frequently abused to lend credibility to phishing pages. The SSL certificate is issued by Google Trust Services, further masking its malicious nature behind trusted encryption standards.

Users who visited trzorsuite-iio.pages.dev or entered any credentials on the site should immediately take corrective action. Disconnect the affected device from the internet to prevent potential data exfiltration. If wallet credentials or recovery seeds were submitted, transfer all assets to a new, secure wallet using a clean device. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to the legitimate service provider for further guidance and consider notifying relevant cybersecurity authorities to aid in tracking the threat. Avoid interacting with any communications from the domain, as follow-up phishing attempts may occur.