trezur-app-suit-en[.]pages[.]dev

PhishDestroy identifies trezur-app-suit-en.pages.dev as an active cryptocurrency-draining campaign masquerading as Trezor Suite. The domain leverages a lookalike page title and HTTPS certificate to appear legitimate while harvesting private keys or transaction approvals. No custom drainer kit artifacts are currently exposed in open-source feeds, indicating a lightweight, template-based deployment aimed at low-effort credential theft rather than sophisticated malware deployment.

Technical indicators align with a high-reputation hosting chain yet reveal red flags: VirusTotal score 9/95, Cloudflare registrar, and Google Trust Services SSL certificate. The page resolves to IP 172.66.44.227 and remains under active tracking with zero blocklist entries as of seed 528fe8, underscoring the need for continuous monitoring and delayed trust decisions.

Despite zero detections on VirusTotal and no known inclusion on Safe Browsing lists, the domain is still active and poses imminent risk to cryptocurrency users seeking wallet management services. Users should avoid clicking links from unsolicited emails or social posts and verify destinations via official Trezor channels. The remaining risk remains elevated until the page is sinkholed or remediated by Cloudflare.