download-trezsuite[.]pages[.]dev

The domain download-trezsuite.pages.dev is currently active and has been identified as a credential‑harvesting site. Infrastructure analysis shows it resolves to the IP address 172.66.47.164, which is hosted by Cloudflare and is served by the authoritative nameservers kimora.ns.cloudflare.com and kip.ns.cloudflare.com. The domain is registered through Cloudflare, Inc., indicating the use of a privacy‑preserving registrar that masks the true registrant. It appears on one public security blocklist and is listed by the PhishDestroy feed, demonstrating that at least one defensive community has already taken mitigation action.

VirusTotal reports that six out of ninety‑one scanning engines flag the domain as malicious, providing independent confirmation of its threat status. No additional public intelligence such as Safe Browsing verdicts, OTX tags, or SSL certificate details have been released, so the full scope of the payload or the exact brand being spoofed remains unknown. The lack of a publicly disclosed page title or brand target means analysts cannot confirm whether the site imitates a specific service, but the detection pattern aligns with generic credential‑theft campaigns that exploit short‑lived domains hosted on cloud platforms. Defenders should treat download‑trezsuite.pages.dev as a high‑confidence indicator of compromise.

Recommended actions include adding the domain and its resolved IP address to DNS‑based blocklists, updating web‑proxy and firewall rules to deny HTTP/HTTPS traffic to the host, and configuring endpoint URL filtering to alert on any attempted connections. Network monitoring should watch for outbound connections to 172.66.47.164, and any internal hosts that resolve the domain should be investigated for potential credential exposure. Because the domain leverages Cloudflare’s infrastructure, rapid takedown may not be feasible; continuous monitoring and containment remain the most effective response.