d2295db6[.]connwa[.]pages[.]dev

Analysis indicates that the domain d2295db6.connwa.pages.dev was registered on February 21 2026 through Cloudflare, Inc. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. HTTP requests return a 403 status code, and the site presents a valid SSL certificate issued by Google Trust Services under the WE1 name, with HSTS and HTTP/3 enabled, confirming the use of Cloudflare’s edge services. The page title observed in the limited snapshot is “Trezor Suite”, and the threat intelligence tags the site as impersonating the Trezor brand, specifically targeting wallet or seed credentials. Google Safe Browsing has flagged the domain for social engineering, and a Gridinsoft trust score of 0 out of 100 reflects an extremely low reputation.

VirusTotal analysis shows that 15 of 93 security vendors have marked the domain as malicious, and the domain appears on one external security blocklist. The site has been taken offline and is currently blocked by the PhishDestroy mitigation service. While the HTTP 403 response limits visible content, the combination of brand‑specific page title, Cloudflare‑based hosting, and the malicious detection profile suggests a deliberate attempt to lure Trezor users into disclosing wallet seeds.

No additional infrastructure such as command‑and‑control servers, phishing form URLs, or content delivery networks beyond Cloudflare has been observed, leaving the full payload delivery chain uncertain. Defenders should continue to monitor the domain for any re‑activation, enforce blocklists that include this host, and add the domain to internal URL filtering rules. Users of Trezor products should be warned that any unsolicited request to a site claiming to be “Trezor Suite” hosted on a cloud‑fronted domain is likely fraudulent, and they should be directed to the official Trezor website for any seed or wallet operations.