host-suite-trzro[.]pages[.]dev

Analysis shows the domain host-suite-trzro.pages.dev was created on March 23 2026 and registered through Cloudflare, Inc. Authority is provided by the nameservers leah.ns.cloudflare.com and santino.ns.cloudflare.com, which resolve the host to the IP address 188.114.97.3, a Cloudflare‑owned server located in Canada. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid certificate chain but offering no assurance of the site’s intent. HTTP requests to the domain return a 403 status code, and the service advertises HSTS and HTTP/3, both typical of Cloudflare‑accelerated sites.

The page title returned from the live endpoint reads “Trezor Suite | Secure Crypto Management Platform”, directly referencing the target brand Trezor and supporting the classification as a crypto‑scam impersonation. Detection data indicate that 10 of 94 security vendors on VirusTotal flagged the domain, and it appears on one external blocklist. PhishDestroy has explicitly blocked the host, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Current status is offline, limiting direct observation of any credential‑harvesting or transaction‑draining components. Defenders should continue to block the domain at network perimeter and endpoint controls, monitor for any resurgence of the host, and update threat‑intel feeds with the observed indicators of compromise, including the registrar, nameserver pair, IP address, TLS certificate issuer, and page title. Additional investigative steps, such as archive retrieval or sandbox execution, may be necessary if the site becomes active again to confirm the exact payload or phishing page employed.