tre-zor-sute[.]pages[.]dev

Analysis indicates that the domain tre-zor-sute.pages.dev was actively impersonating Trezor, a hardware cryptocurrency wallet provider, as of July 24, 2026. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to the IP address 188.114.96.3 (AS13335, Cloudflare, Inc., US). Infrastructure review confirms Cloudflare nameservers (nataly.ns.cloudflare.com, mike.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The HTTP status returned a 403 Forbidden response, and the page title was flagged by Cloudflare as 'Suspected phishing site.' Detection data reveals limited but targeted coverage: three of ninety-three security vendors on VirusTotal flagged the domain, and it appears on one security blocklist, specifically PhishDestroy.

Gridinsoft assigned a trust score of 0/100, consistent with confirmed phishing infrastructure. The domain was classified as a crypto scam, though no further technical artifacts (e.g., phishing kit signatures, wallet addresses, or redirect chains) are currently available for deeper analysis. Defenders should treat this domain as high-risk for Trezor brand impersonation.

The 403 status and offline status suggest takedown or mitigation, but historical resolution data should be reviewed for prior malicious activity. Network-level blocking of 188.114.96.3 and monitoring for new subdomains under pages.dev with similar naming patterns (e.g., 'trezor', 'wallet', 'suite') are recommended. No evidence links this domain to broader campaign infrastructure, but correlation with other Trezor-themed phishing domains registered via Cloudflare may reveal additional threats.