trzorsuite[.]pages[.]dev

Analysis as of July 23 2026 indicates that the domain trzorsuite.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. The authoritative nameservers are eloise.ns.cloudflare.com and brett.ns.cloudflare.com, pointing to Cloudflare’s edge network (ASN 13335). DNS resolution returns the IP address 104.21.48.1, which is located in the United States and is part of Cloudflare’s global CDN. The site serves an HTTPS certificate issued by Google Trust Services under the WE1 root, confirming that TLS termination is performed by Cloudflare’s proxy layer. HTTP responses currently return a 403 status, and the site is marked as offline in the intelligence feed. Google Safe Browsing classifies the domain as a social‑engineering threat, and the payload is identified as a “Crypto Scam” that impersonates the Sui brand.

The page title presented by the server – “Trezor Suite 2025 — Secure Setup, Features & Daily Use Guide” – suggests a deliberate attempt to lure users seeking legitimate Trezor or Sui services. The domain has been flagged by 12 of 93 security vendors on VirusTotal and appears on one external blocklist. Gridinsoft’s trust scoring engine assigns a rating of 0 / 100, indicating an extremely low reputation. The site also appears on the PhishDestroy blocklist, confirming that at least one anti‑phishing consortium has taken mitigation action. The available data do not include a content scrape, so the exact layout, credential‑capture mechanisms, or malicious scripts remain unverified.

Likewise, the presence of any command‑and‑control callbacks or downloader components cannot be confirmed without a live sample. Defenders should therefore treat any traffic to trzorsuite.pages.dev as malicious. Recommended actions include adding the domain to network‑level blocklists, configuring DNS‑sinkhole entries, and monitoring TLS handshake logs for the associated Cloudflare certificate fingerprint.