trezor-suite-lg[.]pages[.]dev

This domain, trezor-suite-lg.pages.dev, poses a direct threat as a cryptocurrency wallet impersonation site targeting Trezor users. Analysis indicates the site was designed to mimic the legitimate Trezor Suite interface, likely to harvest wallet credentials, recovery seeds, or other sensitive authentication details. The domain leverages Cloudflare Pages infrastructure, a common tactic to obscure hosting origins and evade initial detection while maintaining a plausible appearance through Cloudflare's SSL certificates and domain registration services.

Technical evidence confirms elevated risk: the domain is flagged by 11 out of 95 security vendors on VirusTotal, appears on one security blocklist, and was created on September 11, 2025. Infrastructure analysis reveals it resolves to 104.21.96.1 (AS13335, Cloudflare, Inc.) and uses an SSL certificate issued by Google Trust Services (WE1). The registrar is Cloudflare, Inc., and the domain was taken offline following detection, though historical records indicate active malicious use prior to deactivation.

Users who visited trezor-suite-lg.pages.dev should immediately revoke any sessions or credentials potentially exposed during the interaction. If wallet credentials or recovery phrases were entered, affected users must transfer assets to a new wallet and perform a full security audit of connected devices. Monitor accounts for unauthorized transactions and report the incident to relevant security teams or blockchain analysis platforms for further tracking. The domain's SSL certificate and hosting path should be added to internal blocklists to prevent future access attempts.