en-suites-ui[.]pages[.]dev

This domain, en-suites-ui.pages.dev, is under investigation for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Registered on April 20, 2026, through Cloudflare, Inc., the domain remains active as of July 12, 2026. Infrastructure analysis reveals it resolves to the IP address 188.114.97.3, with an SSL certificate issued by Google Trust Services. The page title, 'Trezor Suite — Securely Manage Your Crypto,' directly mimics Trezor’s official branding, suggesting an intent to deceive users into believing the site is legitimate. The domain is hosted on Cloudflare’s infrastructure, utilizing HTTP/3 and HSTS, which are common among both legitimate and malicious sites. It appears on one security blocklist, specifically PhishDestroy, indicating prior detection by at least one vendor. No detections were reported by the 95 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety. The Gridinsoft trust score of 0/100 further signals potential risk. Defenders should treat this domain as suspicious due to its recent registration, brand impersonation, and presence on a security blocklist. While concrete evidence of malicious activity is limited, the combination of infrastructure indicators and brand mimicry warrants caution. Monitoring for additional detections or user reports is recommended to assess whether this domain is part of a broader phishing campaign targeting cryptocurrency users.