trezor-suite-sm[.]pages[.]dev

Analysis of the domain trezor-suite-sm.pages.dev indicates it was part of a crypto-focused phishing operation impersonating Trezor, a hardware cryptocurrency wallet provider. The domain, registered on February 21, 2026, through Cloudflare, Inc., resolved to the IP address 172.66.47.61, hosted on Cloudflare's infrastructure (AS13335) in the United States. As of July 24, 2026, the domain returns an HTTP 403 status, and Cloudflare's interstitial page explicitly labels it as a 'Suspected phishing site,' confirming its malicious classification. Infrastructure analysis reveals the domain leveraged Cloudflare's nameservers (lynn.ns.cloudflare.com and vida.ns.cloudflare.com) and employed standard security technologies such as HSTS and HTTP/3. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare's default configuration and does not provide additional attribution.

Detection data from security vendors shows mixed but notable coverage: Gridinsoft assigned a trust score of 0/100, while Scamadviser rated it 41/100, reflecting uncertainty or partial detection. Nine of 93 security vendors on VirusTotal flagged the domain as malicious, though the specific detection rules or payloads are not detailed in available intelligence. The domain appears on at least one security blocklist, corroborating its phishing classification. The scam type is explicitly categorized as a 'Crypto Scam,' and the domain's naming convention (trezor-suite-sm) strongly suggests an attempt to impersonate Trezor's official software or services.

However, without access to the live page content, the exact phishing mechanics—such as whether it distributed malware, harvested credentials, or facilitated crypto drainer attacks—remain unconfirmed. Defenders should treat this domain as compromised infrastructure and prioritize blocking it at the DNS or network level. Given its current offline status, monitoring for re-activation or related domains (e.g.