7c87a3fa[.]ngddguteetdy[.]pages[.]dev

The domain 7c87a3fa.ngddguteetdy.pages.dev is currently offline but exhibits a complete phishing infrastructure targeting the Trezor brand. The site was registered through Cloudflare, Inc. and resolves to IP 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Traffic to the domain was served over HTTPS using a Google Trust Services / WE1 certificate, with HSTS and HTTP/3 enabled, indicating a modern TLS configuration. The page title returned by the server is "Trezor Suite," directly impersonating the official Trezor suite application.

The underlying phishing kit is identified as a Seed Phrase Phishing kit, classified as wallet/seed phishing, and the site was flagged by Google Safe Browsing for social engineering. VirusTotal analysis recorded 13 detections out of 93 scanned vendors, reinforcing the malicious nature of the host. Additional security controls have already acted: PhishDestroy has blocked the domain, it appears on one external security blocklist, and Gridinsoft assigns it a trust score of 0 out of 100.

The HTTP response code is 403, and the authoritative nameservers could not be resolved (NS_NOT_FOUND). For defenders, the recommendation is to immediately block the domain at network perimeters and email gateways, add the associated IP address to deny lists, and monitor Cloudflare‑hosted subdomains for re‑use of the same infrastructure. Continuous observation of the AS13335 range for similar seed‑phrase phishing patterns is advised, as well as updating endpoint protection signatures to include the 13 VirusTotal detections linked to this host.