trizr-io[.]pages[.]dev

The domain trizr-io.pages.dev is identified as a brand impersonation threat targeting Trezor, a cryptocurrency wallet provider. Analysis indicates the domain was designed to mimic the official Trezor Suite application, potentially facilitating unauthorized access to user credentials or cryptocurrency assets. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used for malicious purposes. Infrastructure analysis reveals the domain was created on October 15, 2025, and resolved to the IP address 188.114.97.3. It was registered through Cloudflare, Inc., a provider commonly used for both legitimate and malicious infrastructure. The domain is flagged by 10 of 95 security vendors on VirusTotal, indicating a high likelihood of malicious intent. Additional indicators include a Gridinsoft trust score of 0/100 and presence on one security blocklist. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's fraudulent nature. The page title, 'Trezor Suite App (Official) | Desktop & Web Crypto Management,' further confirms the intent to deceive users into believing the site is authentic. The domain is currently offline, reducing immediate risk to users. However, similar threats may re-emerge under different domains or infrastructure. Users and organizations are advised to verify the authenticity of cryptocurrency management platforms by accessing them exclusively through official sources. Security teams should monitor for domains with similar naming patterns, registrar profiles, or resolving IPs. Blocking known malicious IPs and domains at the network level, along with educating users on recognizing brand impersonation tactics, is recommended to mitigate future risks.