home-suitesd-trizor[.]pages[.]dev

The domain home-suitesd-trizor.pages.dev was registered on September 18, 2025 through Cloudflare, Inc. and resolves to the IP address 172.66.44.105, which is hosted by Cloudflare (AS13335) in the United States. The site presents the page title "Trezor Suite® | Getting Started" and returns an HTTP 403 response, indicating that access is currently restricted. Technical fingerprints show the presence of HTTP Strict Transport Security (HSTS), HTTP/3, and a TLS certificate identified as "WE1".

The infrastructure is listed on a single security blocklist, PhishDestroy, and the domain has a Gridinsoft trust score of 0 out of 100, suggesting a lack of trustworthiness. VirusTotal reports indicate that the domain has been scanned by 94 antivirus vendors with no detections at the time of analysis, but this absence of flags does not constitute evidence of safety. The observed characteristics align with a wallet/seed phishing campaign that impersonates the "foundation" brand, as indicated by the supplied intelligence.

Given the domain’s recent creation, use of Cloudflare’s DNS and edge services, and its inclusion on a known phishing blocklist, defenders should treat the domain as malicious until further evidence proves otherwise. Recommended actions include adding the domain to internal blocklists, monitoring DNS queries for the associated nameservers (ernest.ns.cloudflare.com, nelly.ns.cloudflare.com), and correlating any attempted connections to the IP 172.66.44.105 with user reports of credential or seed phrase solicitation. Continuous re‑evaluation is advised, as the domain may be re‑activated or altered in the future.