e7e12ce8[.]pathsss[.]pages[.]dev

The domain e7e12ce8.pathsss.pages.dev is currently listed as offline but exhibits multiple indicators of a high‑risk brand‑impersonation campaign targeting Trezor users. The domain resolves to the IP address 172.66.44.249, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is performed by the Cloudflare nameservers adi.ns.cloudflare.com and karl.ns.cloudflare.com, confirming that the infrastructure is hosted behind Cloudflare’s edge network. The site presents an SSL certificate issued by Google Trust Services under the WE1 intermediate, a typical certificate chain for Cloudflare‑proxied domains, and enforces HSTS and HTTP/3, suggesting a modern TLS configuration. HTTP responses return a 403 status code, indicating that direct content delivery is blocked, yet the page title "Trezor Suite" is still observable, confirming the intent to mimic the official Trezor web interface.

The campaign is classified as a wallet/seed phishing operation and employs a Seed Phrase Phishing kit, consistent with the brand‑targeted impersonation of Trezor. Detection data shows the domain appears on a single security blocklist (PhishDestroy) and is flagged by Google Safe Browsing for social‑engineering content. VirusTotal analysis recorded 15 detections out of 95 scanning engines, reinforcing the malicious assessment. Additional reputation metrics include a Gridinsoft trust score of 0 out of 100, effectively indicating no confidence in the domain’s legitimacy.

While the site is presently offline, the observed infrastructure—Cloudflare edge hosting, a valid Google‑issued certificate, and the presence of HSTS and HTTP/3—demonstrates that the operators can rapidly reactivate the domain if needed. Defenders should continue to monitor the domain for re‑appearance, block the associated IP address 172.66.44.249 at network perimeters, and add the domain to local blocklists.