523daaa5[.]ngddguteetdy[.]pages[.]dev

Analysis of the domain 523daaa5.ngddguteetdy.pages.dev indicates it was actively involved in a high-risk wallet seed-phishing campaign targeting Trezor users. The domain, hosted on Cloudflare infrastructure (IP 172.66.46.236, AS13335), was registered through Cloudflare, Inc. on September 2, 2020, and uses Cloudflare nameservers (adi.ns.cloudflare.com, karl.ns.cloudflare.com). Its SSL certificate, issued by Google Trust Services (WE1), aligns with standard Cloudflare deployments but does not mitigate the phishing risk. The page title, 'Trezor Suite,' directly corresponds to the official Trezor wallet interface, confirming the intent to impersonate the brand. Google Safe Browsing classified the domain under 'social engineering,' and it was blocked by PhishDestroy, a security blocklist.

Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. As of July 25, 2026, the domain resolves to a 403 HTTP status, suggesting it has been taken offline or restricted, though residual DNS records persist. VirusTotal detections from 13 of 93 security vendors further validate the phishing classification, with the domain linked to a seed phrase phishing kit—a common tactic for cryptocurrency wallet compromise. The exact content of the phishing page remains unconfirmed, but the combination of brand impersonation, seed-phishing classification, and blocklist inclusion provides strong evidence of malicious intent.

Defenders should treat this domain as part of a broader phishing infrastructure. While currently offline, the domain’s Cloudflare registration and historical activity warrant monitoring for reactivation. Organizations should update blocklists to include this domain and its associated IP (172.66.46.236) to prevent accidental access. No additional brand-specific indicators or victim data are available at this time.