en-suites[.]pages[.]dev

This domain, en-suites.pages.dev, is actively impersonating Trezor, a cryptocurrency hardware wallet provider, as part of a seed-phishing campaign. Registered on August 19, 2025, through Cloudflare, Inc., the domain remains operational as of July 12, 2026. Infrastructure analysis reveals it is hosted on Cloudflare’s network, resolving to the IPv6 address 2606:4700:310c::ac42:2d29 (AS13335, United States). The site employs HTTP/3 and HSTS, with a 301 HTTP status redirect, though the destination remains unconfirmed. Nameservers are consistent with Cloudflare’s infrastructure (alina.ns.cloudflare.com, troy.ns.cloudflare.com). The page title, 'Welcome to Suite,' aligns with Trezor’s branding, though the exact content and functionality of the site have not been analyzed. Security vendors have flagged the domain, with 9 of 95 engines on VirusTotal detecting malicious activity. It appears on at least one blocklist (PhishDestroy), and Gridinsoft assigns it a trust score of 0/100. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted domains. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency-related services are accessed. Given the seed-phishing classification, the site likely targets users attempting to recover or initialize Trezor wallets, aiming to harvest recovery phrases. No evidence suggests compromise of Trezor’s official infrastructure, but users should verify domain authenticity before entering sensitive information. Further analysis of the redirect chain and payload is recommended to determine the full scope of the campaign.