tzer--suite--info[.]pages[.]dev

This domain is flagged as an elevated-risk brand impersonation threat designed to deceive users of the Sui cryptocurrency ecosystem. Analysis indicates the site masquerades as a legitimate Web3 application gateway, likely aiming to facilitate crypto asset theft or credential harvesting under the guise of secure dApp connectivity. The impersonation targets users familiar with Sui-related services, exploiting trust in established brands to execute fraudulent transactions or data exfiltration. Infrastructure analysis reveals the domain resolves to IP address 172.66.47.158 and was registered through Cloudflare, Inc. on April 04, 2026. The SSL certificate is issued by Google Trust Services, a common tactic to appear legitimate. Detection metrics show 11 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The page title, 'Trezor Suite - Web3 App Gateway | Securely Connecting to DApps,' further confirms the attempt to impersonate a trusted cryptocurrency wallet interface, despite no affiliation with the actual Trezor or Sui brands. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (172.66.47.158) at the network perimeter. Security teams should update detection rules to flag similar domains leveraging Cloudflare Pages infrastructure with cryptocurrency-related branding. End-users should be educated to verify domain authenticity before interacting with Web3 gateways, particularly those requesting wallet connections or private key access. Monitoring for newly registered domains with similar naming patterns (e.g., 'suite,' 'web3,' or 'dapp') can help preemptively identify related threats. Organizations should also review logs for connections to 172.66.47.158 to assess potential compromise.