trzor-siutt[.]pages[.]dev

PhishDestroy has analyzed the domain trzor-siutt.pages.dev, which was found to be conducting a brand impersonation phishing campaign specifically targeting Trezor users. The domain is currently offline, having been taken down after its malicious activity was identified. The page title, 'Trezor Suite - Secure Crypto Management', was designed to deceive visitors into believing they were accessing the legitimate Trezor Suite platform.

Technical analysis reveals that the domain was created on March 25, 2026, and registered through Cloudflare, Inc. It resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services / WE1. VirusTotal flagged the domain with 1 out of 95 security vendors marking it as malicious, and it appears on 1 security blocklist. These indicators, combined with the domain's recent creation and brand impersonation tactics, point to a targeted phishing operation aimed at stealing cryptocurrency credentials.

Given that the domain is now offline, the immediate risk to users is reduced. However, PhishDestroy recommends that Trezor users remain vigilant against similar domains and always verify URLs before entering sensitive information. Users should enable two-factor authentication, use hardware wallets for crypto storage, and report any suspicious communications to Trezor's official support channels. Regular monitoring of phishing databases and blocklists is advised to stay protected against evolving threats.