0b282582[.]kfhhfdue[.]pages[.]dev

On July 25 2026 analysts observed that the sub‑domain 0b282582.kfhhfdue.pages.dev is hosting a high‑risk brand‑impersonation campaign targeting the hardware‑wallet provider Trezor. The site resolves to the Cloudflare‑owned IP address 172.66.47.129, which is registered to Cloudflare, Inc. in the United States under ASN 13335. An HTTP request to the domain returns a 403 status code, and the TLS certificate is issued by Google Trust Services (WE1), indicating a valid HTTPS endpoint despite the denial of access. The page title reported by the crawler is "Trezor Suite," matching the advertised product name and reinforcing the impersonation vector.

VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain as malicious, and Google Safe Browsing classifies the URL as a social‑engineering threat. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft’s trust score for the domain is 0 out of 100, reflecting an extremely low reputation. Technical fingerprinting reveals the use of HSTS, Cloudflare’s edge network, and HTTP/3, all of which are typical for fast‑forwarded phishing infrastructure.

Threat intelligence identifies the campaign as a crypto‑scam employing a seed‑phrase phishing kit, which is designed to harvest cryptocurrency recovery phrases from unsuspecting victims. No nameserver records were returned (NS_NOT_FOUND), limiting the ability to trace delegation details. The combination of a legitimate‑looking page title, a trusted TLS certificate, and the use of Cloudflare’s CDN suggests an attempt to lend credibility to the malicious landing page.

Defenders should block outbound connections to 172.66.47.129 at the network perimeter, add the full domain to URL filtering policies, and monitor for any credential‑submission attempts referencing Trezor or seed phrases.