076ab655[.]demmoo-5p7[.]pages[.]dev

Analysis indicates that the domain 076ab655.demmoo-5p7.pages.dev was used to host a Trezor Suite impersonation page. The page title observed in HTTP responses is “Trezor Suite”, matching the declared brand target of Trezor and aligning with the wallet/seed phishing classification. The site was served over HTTPS with a certificate issued by Google Trust Services under the WE1 trust chain, and HSTS was observed, suggesting the operators attempted to convey legitimacy. Traffic was routed through Cloudflare, as evidenced by the nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com and the origin IP 172.66.47.75, which belongs to AS13335 Cloudflare, Inc., located in the United States.

The HTTP response returned a 403 status code, which is consistent with a site that has been taken offline after detection. The underlying phishing kit was identified as a Seed Phrase Phishing kit, a known vector for extracting cryptocurrency recovery phrases. VirusTotal reports show that 14 of 93 scanning engines flagged the domain, and Google Safe Browsing lists it under social engineering, confirming malicious intent. The domain was created on 2 September 2020 and is registered through Cloudflare, Inc. It appears on a single blocklist and has been blocked by PhishDestroy.

Gridinsoft assigned a trust score of 0 out of 100, indicating no perceived trustworthiness. While the site is currently offline, the combination of brand impersonation, seed‑phrase kit, and Cloudflare‑based hosting suggests a reusable infrastructure that could be redeployed under different subdomains. Defenders should continue to block the domain at network perimeter, add the IP address 172.66.47.75 to deny lists, and monitor for new pages.dev subdomains that resolve to Cloudflare IP ranges and present similar TLS fingerprints.