trezor-suite-faq-eng[.]pages[.]dev

Analysis of the domain trezor-suite-faq-eng.pages.dev indicates a confirmed crypto phishing operation targeting Trezor, a well-known cryptocurrency hardware wallet provider. The domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, part of Cloudflare's network (AS13335). At the time of assessment, the domain returns an HTTP 403 status, suggesting it has been taken offline or restricted, though it previously presented a page titled 'Suspected phishing site | Cloudflare,' reinforcing its malicious classification. Infrastructure analysis reveals the use of Cloudflare nameservers (bill.ns.cloudflare.com and elsa.ns.cloudflare.com) and technologies such as HSTS and HTTP/3, which are consistent with modern phishing campaigns leveraging legitimate CDN services to evade detection.

The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing domains frequently employ valid certificates to appear legitimate. Gridinsoft assigns a trust score of 0/100, categorizing the domain as a crypto scam, and it appears on at least one security blocklist. Sixteen of 93 security vendors on VirusTotal flagged the domain as malicious, providing further evidence of its fraudulent nature.

While the exact content of the site remains unanalyzed due to its offline status, the domain name, page title, and scam classification strongly suggest an attempt to impersonate Trezor's official support or FAQ pages, likely aiming to harvest cryptocurrency wallet credentials or seed phrases. Defenders should treat this domain as a high-confidence threat, block it at the network level, and monitor for related infrastructure, such as subdomains or newly registered lookalike domains under Cloudflare Pages.