tre-zor-s-uite[.]pages[.]dev

PhishDestroy identifies active domain tre-zor-s-uite.pages.dev as an elevated-risk Trezor brand impersonation used for cryptocurrency theft operations.

This domain impersonates the Trezor hardware wallet brand and is currently active as of the latest threat intelligence review. According to VirusTotal analysis, it has been flagged by 2 of 95 participating security vendors, indicating limited but growing detection coverage. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.47.109 and secured with a Google Trust Services SSL certificate.

Risk assessment places this domain at an elevated threat level due to direct association with a high-value cryptocurrency brand and the use of a legitimate hosting provider to enhance credibility. The presence of an SSL certificate issued by a trusted authority (Google Trust Services) increases the likelihood of user deception. Concrete mitigation steps include immediate network-level blocking of the domain and IP address, user awareness campaigns highlighting Trezor-specific impersonation red flags, and reporting the domain to relevant abuse channels such as Cloudflare's Trust & Safety team. Given the active status and misuse of a legitimate cloud service, organizations handling cryptocurrency assets should prioritize blocking this domain to prevent financial loss.