trezoor-suites[.]pages[.]dev

PhishDestroy identifies trezoor-suites.pages.dev as an ACTIVE crypto drainer impersonating the official Trezor Suite web interface. This malicious domain leverages a spoofed branding strategy to trick users into connecting crypto wallets under the false pretense of accessing legitimate Trezor services. The threat actor appears to be distributing a drainer script via the Cloudflare Pages platform, designed to siphon funds from victims' connected wallets upon wallet signature approval. Initial behavioral analysis indicates the drainer kit is hosted on a subdomain structure under pages.dev, a known hosting service often exploited for phishing campaigns due to its legitimate CDN integration.

This domain was flagged on PhishDestroy with zero detections out of 95 VirusTotal scanners as of the latest scan, indicating it currently evades most antivirus and security vendor signatures. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.96.3, which is part of Cloudflare’s edge network. The SSL certificate is issued by Google Trust Services, a tactic commonly used to establish false trust in phishing sites. No blocklist entries were found at the time of analysis, and the domain’s creation date remains unreported due to Cloudflare’s privacy protections. The absence of detections suggests a newly deployed campaign with a high potential for success against unsuspecting users.

As of this report, trezoor-suites.pages.dev remains ACTIVE with a risk level classified as under_investigation. PhishDestroy has flagged this domain and is collaborating with threat intelligence partners to enhance detection coverage. Users are strongly advised to avoid interacting with this domain and to verify any Trezor-related links using the official PhishDestroy verification system. The current risk is assessed as HIGH given the domain’s active status, use of reputable infrastructure (Cloudflare), and lack of signature-based detection. It is expected that detection rates will increase as the campaign is further analyzed by the security community.