guide-trzor-suite-us[.]pages[.]dev

This domain, guide-trzor-suite-us.pages.dev, is an active phishing site impersonating Trezor Suite, flagged by 11 of 91 security vendors on VirusTotal as of the latest scan. Registered on June 10, 2026, through Cloudflare Pages, it appears on at least one security blocklist and is currently blocked by PhishDestroy. The domain's infrastructure is hosted on Cloudflare's network, a common choice for phishing campaigns due to its ease of deployment and built-in SSL certificates, which may lend a false sense of legitimacy to targets.

While the exact content of the site has not been analyzed, the domain name strongly suggests an attempt to deceive users of Trezor hardware wallets by mimicking the official Trezor Suite interface, likely to harvest credentials or cryptocurrency wallet recovery phrases. Defenders should treat this domain as high-risk and prioritize blocking it at the network level, particularly in environments where cryptocurrency-related services are accessed.

Given the elevated detection rate and presence on blocklists, organizations should also review logs for connections to this domain and investigate any associated endpoints for signs of compromise. The use of Cloudflare Pages as a hosting provider complicates takedown efforts, so defenders should monitor for changes in IP resolution or new subdomains that may emerge as part of this campaign.