suite-trez--ror[.]pages[.]dev

The domain suite-trez--ror.pages.dev is a phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It presents itself as the legitimate Trezor Suite platform to deceive users into entering sensitive credentials or wallet information, posing an elevated risk of financial theft. No crypto drainer kit was identified, but the site was operational long enough to collect user data before being taken offline.

Technical indicators confirm the malicious nature of suite-trez--ror.pages.dev. The domain was flagged by 5 of 95 VirusTotal security vendors, including ADMINUSLabs, CyRadar, and Fortinet, and appears on one security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on March 24, 2026, it resolved to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title mimicked Trezor Suite — Hardware Wallet for Safe Crypto Storage. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with suite-trez--ror.pages.dev should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on their Trezor and associated accounts, and monitor for unauthorized transactions. If cryptocurrency wallet details were exposed, revoke any active token approvals and transfer funds to a new, secure wallet. Report the phishing domain to Trezor’s official security team, Cloudflare’s abuse reporting system, and platforms like Google Safe Browsing or PhishTank to aid in takedown efforts.