en-suite-web[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting cryptocurrency wallet users. Analysis indicates the site en-suite-web.pages.dev specifically mimics Trezor Suite, a legitimate crypto wallet interface, with the intent to harvest credentials, private keys, or seed phrases from unsuspecting victims. The threat type is classified as crypto-phishing, leveraging social engineering to exploit trust in established brands within the blockchain ecosystem. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on August 18, 2025, and resolves to the IP address 172.66.45.24. The site employed HSTS and HTTP/3 protocols, alongside a Google Trust Services SSL certificate, to present a facade of legitimacy. VirusTotal detection metrics show 15 out of 95 security vendors flagged the domain as malicious. The domain appears on three security blocklists and is actively blocked by cryptocurrency security tools, including MetaMask and PhishDestroy. The page title, 'Trezor Suite - Secure Your Crypto Wallet,' directly mirrors the legitimate service, increasing the likelihood of successful deception. Mitigation requires immediate action from both end-users and security teams. Users who accessed en-suite-web.pages.dev should assume credential compromise and revoke all active sessions on their crypto wallets. They must generate new seed phrases, transfer assets to new wallet addresses, and monitor for unauthorized transactions. Security teams should add the domain and its resolving IP (172.66.45.24) to enterprise blocklists, along with associated SSL certificate fingerprints. Network-level detection rules should be updated to flag similar Cloudflare-hosted pages impersonating crypto services. Given the domain's recent creation date, proactive threat hunting for related infrastructure (e.g., subdomains, redirect chains) is recommended to identify and neutralize secondary attack vectors.