eng-suitstrezr[.]pages[.]dev

The domain eng-suitstrezr.pages.dev was observed on 2026-07-25 as an elevated‑risk brand‑impersonation site targeting Trezor users. The site presented the page title “Official Trezor™ Suite — Desktop”, indicating an attempt to masquerade as the official Trezor Suite application. Infrastructure analysis shows the domain is hosted on Cloudflare’s edge network; DNS resolves to IP address 188.114.96.3, which is registered to Cloudflare, Inc. in Canada. Both authoritative nameservers, ada.ns.cloudflare.com and ned.ns.cloudflare.com, belong to Cloudflare, confirming the use of their CDN and security services. The web server responded with HTTP status code 403 and enforced HSTS over HTTP/3, while presenting an SSL certificate issued by Google Trust Services under the WE1 profile.

Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal has recorded three detections out of ninety‑four scanned engines, and the domain appears on a single external blocklist. PhishDestroy has already blocked the host. The reported scam type is “Crypto Scam”, consistent with the Trezor brand focus.

At the time of reporting the site was taken offline, and no page content could be retrieved for further behavioural analysis. Defenders should continue to block the domain and its resolving IP at network perimeter, add the host to internal threat‑intel feeds, and monitor for any re‑hosting attempts using the same Cloudflare configuration. TLS inspection can confirm the presence of the Google Trust Services certificate, and HSTS enforcement should be respected. Given the low trust score, multiple vendor detections, and explicit brand impersonation, the domain should be treated as malicious and excluded from any allow lists.