trezor-website-ram-pod-paint-sigma-gole-324324-psi[.]vercel[.]app

The domain trezor-website-ram-pod-paint-sigma-gole-324324-psi.vercel.app was registered through Vercel Inc. and resolves to the Amazon‑owned IP address 216.198.79.3, associated with ASN 16509. The site served a page titled “Connect & Find Your Trezor” and presented a TLS certificate issued by Google Trust Services under the WR1 root, indicating a valid HTTPS connection. Infrastructure analysis shows the use of Vercel hosting and the presence of HTTP Strict Transport Security (HSTS). The domain returned HTTP status 451, indicating that the content was unavailable for legal reasons, and it is currently listed as taken offline.

The site impersonates the Trezor hardware‑wallet brand and is classified as a crypto‑scam. It was blocked by the PhishDestroy blocklist and appears on a single security blocklist. VirusTotal scans recorded nine detections out of ninety‑five engines, reinforcing the malicious classification. Nameserver information is unavailable (NS_NOT_FOUND).

The evidence confirms that the domain was created to lure Trezor users into a credential‑harvesting flow, leveraging a legitimate‑looking page title and a trusted SSL certificate to increase credibility. Uncertainty remains regarding the specific payload delivered to victims, as the page content has not been captured and no visual artefacts have been disclosed. Defenders should continue to monitor the IP range owned by Amazon for similar Vercel‑hosted impersonation attempts, enforce blocklist updates to include this domain, and advise users to verify URLs against official Trezor resources. Threat intelligence feeds should flag the domain as a brand‑impersonation crypto scam, and any residual DNS entries should be purged to prevent resurrection attempts.