suit-secur[.]pages[.]dev

On July 23, 2026, analysis of the domain suit-secur.pages.dev identified it as a cryptocurrency‑related impersonation of the Trezor hardware‑wallet brand. The site’s HTML title reads “Trezor Suite – Secure Hardware Wallet for Cryptocurrency Storage,” directly referencing the official product name. The domain was registered on March 23, 2026 through Cloudflare, Inc., and uses the Cloudflare nameservers bob.ns.cloudflare.com and kayleigh.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare’s network located in Canada. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration; HSTS and HTTP/3 are also observed, consistent with modern Cloudflare deployments.

An HTTP request to the host returns a 403 status code, and the domain is currently taken offline. Threat‑intelligence feeds show the domain appears on a single security blocklist and is flagged by PhishDestroy. VirusTotal scans report 16 of 94 security vendors labeling the domain as malicious, confirming a moderate level of detection across independent scanners. Gridinsoft assigns a trust score of 0 out of 100, effectively marking the site as untrusted. The listed scam type is “Crypto Scam,” aligning with the Trezor brand impersonation.

While the site is presently offline, the combination of a brand‑specific page title, recent registration, Cloudflare‑hosted infrastructure, and multi‑vendor detection suggests a deliberate attempt to lure cryptocurrency users into a credential‑harvesting or fund‑diversion operation. The exact payload, page content, and credential‑capture mechanisms have not been captured, leaving the full attack vector uncertain. Defenders should continue to block the domain at network perimeter and DNS resolvers, monitor for any resurgence of the host, and add the IP address 188.114.97.3 to threat‑intel feeds.