net-trezzor-wallet-data-bandwidth[.]vercel[.]app

Analysis of net-trezzor-wallet-data-bandwidth.vercel.app indicates an active crypto drainer phishing domain targeting users of the Trézor hardware wallet. The domain, registered through Vercel, resolves to 216.198.79.3 (Lefkoff Industries, US) and presents a page titled 'Trézor.io/Start® | Starting Up Your Device - Trézor®,' directly mimicking the official Trézor setup portal. As of July 19, 2026, the domain returns an HTTP 200 status and remains unblocked by most security vendors, though 19 of 91 engines on VirusTotal flag it as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious deployments. Infrastructure analysis reveals the domain leverages Vercel’s hosting platform, which is frequently abused for rapid phishing deployments due to its ease of use and free tier. The use of 'trezzor' in the subdomain (misspelled with an additional 'z') is a deliberate tactic to deceive users familiar with the Trézor brand. No evidence of a phishing kit or additional payloads has been confirmed at this stage, but the domain’s design and title strongly suggest intent to harvest wallet credentials or seed phrases. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency-related activity is common. Security teams are advised to monitor for connections to 216.198.79.3 and review logs for interactions with the page title 'Trézor.io/Start® | Starting Up Your Device - Trézor®.' Given the high-risk classification and active status, immediate takedown requests to Vercel and relevant CERT teams are recommended. Further investigation into associated wallet addresses or drainer scripts may be warranted if additional telemetry becomes available.