c1b93000[.]bvfhgvuddfh[.]pages[.]dev

Analysis of the domain c1b93000.bvfhgvuddfh.pages.dev confirms that it is a high-risk seed phrase phishing site impersonating the Trezor brand. The domain was created on September 02, 2020, and has been flagged by Google Safe Browsing for social engineering, indicating malicious intent. Infrastructure analysis reveals that the domain is registered through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.14, which is located in the United States and is part of Cloudflare's network (AS13335). The domain uses advanced technologies such as HSTS and HTTP/3, which can enhance its credibility and make it more resilient to certain types of detection. The SSL certificate is issued by Google Trust Services, further complicating its identification as a malicious site.

The page title, 'Trezor Suite,' aligns with the impersonation of the Trezor brand, a known target for phishing attacks. The domain has been marked as high risk, with a Gridinsoft trust score of 0/100, indicating a significant lack of trustworthiness. It is also present on one security blocklist, which is an additional indicator of its malicious nature. The HTTP status code of 403 suggests that the site is currently inaccessible, possibly due to defensive measures or the removal of the phishing content.

Nameservers for the domain are adi.ns.cloudflare.com and karl.ns.cloudflare.com. Security researchers and defenders should remain vigilant, as the domain has a history of being used for seed phrase phishing. The site should be treated as a confirmed phishing threat, and users should be advised to avoid interacting with it. Defenders should monitor for any signs of the domain becoming active again and consider blocking access to it to protect potential victims.