terse-es-i[.]pages[.]dev

Analysis indicates that the domain terse-es-i.pages.dev was registered on March 23, 2026 through Cloudflare, Inc. The site resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada. The TLS certificate is issued by Google Trust Services under the WE1 identifier, and the site enforces HSTS while supporting HTTP/3, confirming the use of Cloudflare’s edge infrastructure. The page title returned by the server is “Official Trezor™ Suite — Desktop”, and the domain is explicitly marked as impersonating the Trezor brand, classifying the activity as a crypto‑related scam. VirusTotal has recorded 10 detections out of 94 scanned security vendors, and the domain appears on a single security blocklist.

PhishDestroy has already taken the domain offline, and an HTTP 403 response is observed, indicating that the content is no longer publicly accessible. Additional reputation signals include a Gridinsoft trust score of 0 / 100 and the presence of the domain on a blocklist, reinforcing the malicious classification. The nameservers are khalid.ns.cloudflare.com and rosemary.ns.cloudflare.com, both owned by Cloudflare, which further confirms the hosting relationship. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms that may have been served before takedown, as no page content has been captured.

No public Safe Browsing or OTX entries were provided, and no additional indicator sets such as malware hashes are available. Defenders should proactively block the IP address 188.114.97.3 and the fully qualified domain name in outbound filtering rules, monitor for any traffic to Cloudflare edge nodes that reference this hostname, and ensure that any detection signatures that include the observed page title or the “Official Trezor™ Suite — Desktop” string are updated.