suit-trezur-down-load[.]pages[.]dev

The domain suit-trezur-down-load.pages.dev is flagged for brand impersonation targeting Trezor, a cryptocurrency wallet provider. This site presents itself as an official source for Trezor Suite downloads, posing a direct threat to users seeking legitimate wallet software. Analysis indicates the domain is currently under investigation for phishing activity. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with a creation date of April 29, 2026. It resolves to the IP address 172.66.44.206 and employs technologies such as HSTS, Cloudflare, and HTTP/3. The SSL certificate is issued by Google Trust Services. Security telemetry shows the domain appears on one blocklist and has been blocked by PhishDestroy. Despite its offline status, the domain has not been flagged by any of the 95 vendors on VirusTotal, yielding a 0/95 detection rate. Gridinsoft assigns a trust score of 0/100, further indicating its suspicious nature. Current status confirms the domain is offline, though historical indicators suggest it was actively used for malicious purposes. Organizations and users are advised to block the domain and associated IP address (172.66.44.206) at the network level. Trezor users should verify all downloads through the official website and avoid third-party sources. Security teams should monitor for related domains leveraging similar naming conventions or infrastructure patterns, particularly those hosted on Cloudflare Pages.