trzor-startup[.]created[.]app

Trzor-startup.created.app is a phishing domain that impersonates the cryptocurrency wallet brand Trezor. This domain, created on July 12, 2023, was detected by PhishDestroy on December 7, 2025. Despite being flagged by 6 out of 95 vendors on VirusTotal, the site has been taken down and is currently offline.

The domain was registered through Tucows Domains Inc. and hosted on an IP address associated with Amazon.com, Inc. in France. It used an SSL certificate issued by Let's Encrypt, which is commonly used for legitimate sites but also exploited by threat actors to lend credibility to phishing domains. The page title "Trezor Suite" was likely designed to deceive users into thinking they were accessing the genuine Trezor platform.

This operation targeted cryptocurrency users, a lucrative target for scammers. By mimicking the Trezor brand, the attackers aimed to steal sensitive information such as recovery phrases or private keys. The domain's presence on public blocklists, including PhishDestroy's, highlights its malicious intent. Although the site is now offline, its brief period of activity underscores the importance of rapid detection and response in combating phishing threats.