nav-trezor-log-webs[.]created[.]app

Analysis of the domain nav-trezor-log-webs.created.app, observed on 24 July 2026, shows a clear brand‑impersonation campaign targeting Trezor users. The domain was registered through Tucows Domains Inc. on 12 July 2023 and is hosted on Vercel infrastructure, as indicated by the detected Vercel technology stack and the authoritative nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The site served an HTTP 404 response and presented the page title “Trezor Bridge – Connect Your Trezor Wallet”, which aligns with the declared scam type of a crypto‑related scam. SSL was provided by Let’s Encrypt (certificate chain R13), and the site enforced HSTS, suggesting an attempt to mimic legitimate security practices.

Network analysis resolves the domain to IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The same IP is associated with other Vercel‑hosted services, offering no unique malicious fingerprint beyond the domain itself. The domain appears on a single security blocklist and is currently blocked by PhishDestroy, confirming that at least one defensive feed has identified it as malicious. VirusTotal reports that 14 of 95 scanning engines flag the domain, providing additional independent confirmation of suspicious behavior.

The domain’s current status is offline, limiting immediate interaction, but the historical evidence indicates a deliberate attempt to lure Trezor users into a credential‑stealing or crypto‑draining workflow. Uncertainty remains regarding the exact payload or data collection mechanisms, as no further page content has been captured beyond the title and HTTP status. Defenders should continue to monitor the associated IP address for any resurgence of activity, enforce blocklists that include this domain, and educate users about the specific impersonation of the Trezor Bridge service. Incident response teams should also verify that any internal references to “nav‑trezor‑log‑webs.created.