cnd-trezsuite-app[.]pages[.]dev

PhishDestroy identifies cnd-trezsuite-app.pages.dev as an active cryptocurrency wallet phishing domain designed to deceive users into surrendering private keys or seed phrases. This domain mimics legitimate crypto service interfaces to trick victims into connecting wallets or submitting sensitive authentication details under the guise of 'trezsuite' functionality. The threat actor leverages Cloudflare Pages hosting to deploy the fraudulent interface, which resolves to IP 172.66.46.223 and operates under a Google Trust Services SSL certificate to appear legitimate. This domain was flagged by only 1 out of 95 VirusTotal security vendors, indicating low detection sensitivity across major scanners despite clear malicious intent. Registered through Cloudflare, Inc., it exploits the Pages platform to rapidly deploy phishing pages with minimal traceability. The use of a Google-issued SSL certificate further enhances its credibility, tricking users into believing the site is secure and affiliated with a trusted service provider. This domain represents an elevated risk due to its active status and deceptive branding targeting crypto users. Users who visited cnd-trezsuite-app.pages.dev should immediately disconnect from the site, scan their devices for malware using reputable antivirus software, and revoke any wallet connections or permissions granted to the domain. Never enter private keys, seed phrases, or wallet passwords on suspicious websites. Report the domain to your antivirus provider and share indicators with threat intelligence platforms. If financial or personal data was exposed, contact your bank and consider freezing accounts. Always verify URLs and use bookmarks for crypto services to avoid typosquatting attacks.