black-moon-trw[.]coteenancee[.]workers[.]dev

This analysis concerns domain black-moon-trw.coteenancee.workers.dev identified as a brand_impersonation incident targeting Trezor cryptocurrency wallet services. The domain is currently reported as offline, indicating successful disruption or takedown following detection by security systems.

Infrastructure telemetry shows TLS certificates issued via Let's Encrypt, with hosting routed through Cloudflare, Inc. The service leverages HTTP/3, HSTS enforcement, and reverse proxy infrastructure consistent with content delivery obfuscation. The domain resolves to IP address 172.67.185.62. Security telemetry indicates 15 of 95 VirusTotal vendors flagged the domain as malicious, and it appears on 1 independent security blocklist. No explicit creation date is available in current intelligence, limiting temporal attribution.

Content and behavioral indicators, including the page title 'Trezor Suite', strongly indicate brand impersonation designed to mimic legitimate cryptocurrency wallet software interfaces. Such patterns are consistent with phishing campaigns aimed at credential harvesting and seed phrase theft. Despite current offline status, historical exposure suggests prior user interaction risk and potential cached propagation across CDN nodes. Risk assessment classifies the infrastructure as elevated due to confirmed vendor detections and brand abuse signals. Recommended mitigations include enforcing domain and IP blocking across DNS, web gateways, and endpoint protection systems, correlating SIEM logs for any connections to 172.67.185.62, and conducting user awareness checks for exposure to fake wallet interfaces. Additionally, defenders should monitor for derivative Cloudflare Workers subdomains and apply heuristic detection for similar impersonation templates.