tqg-rft-ewq-zhu-obj-rwf-win[.]netlify[.]app

Analysis indicates that the domain tqg-rft-ewq-zhu-obj-rwf-win.netlify.app is currently hosting a crypto‑related brand impersonation campaign targeting Trezor users. The site returns HTTP 200 and presents the page title "Connect & Unlock," a cue commonly used in credential‑collection schemes. Infrastructure traces show the domain resolves to the IPv6 address 2406:da18:b3d:e201::259, located in Singapore and announced by AS16509 (Amazon.com, Inc.). Hosting is performed through Netlify, as confirmed by the Netlify technology fingerprint and the presence of HSTS headers. The SSL certificate is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, confirming the use of a legitimate certificate authority. Domain registration dates back to 09 May 2018, and the authoritative nameservers are dns1.p01.nsone.net through dns4.p01.nsone.net, typical of Netlify‑hosted sites. Threat intelligence flags the domain as high‑risk and active; 12 of 93 VirusTotal scanners have identified it as malicious, and it appears on a single external blocklist. Further risk indicators include a Gridinsoft trust score of 0/100 and a blocklisting by PhishDestroy. While the exact malicious payload is not disclosed, the combination of a Trezor‑related page title, crypto scam classification, and the observed infrastructure strongly suggests credential harvesting or unauthorized wallet access attempts. Defenders should immediately block the domain at perimeter firewalls, update URL filtering lists, and monitor for related DNS queries or outbound connections to the identified IP address. Continuous re‑inspection of the site’s content and periodic VirusTotal rescans are recommended to capture any evolution in the threat profile.