learn-io-trezer[.]netlify[.]app

Analysis of learn-io-trezer.netlify.app indicates a brand-impersonation phishing domain targeting Metamask users. The domain, created on February 21, 2026, was hosted on Netlify infrastructure and resolved to IP 35.157.26.135 (AS16509, Amazon.com, Inc., Germany). As of July 23, 2026, the site returns an HTTP 404 status, suggesting it has been taken offline, though its prior activity remains a confirmed threat. The page title, 'Trezor.io/Start® | Securely Set Up Your Trezor Hardware Wallet,' explicitly impersonates Trezor, a hardware wallet brand, while the scam type is classified as wallet/seed phishing—a tactic designed to harvest cryptocurrency wallet recovery phrases. Detection data shows 18 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appears on at least one security blocklist.

The domain was registered through Name.com, Inc. (Netlify) and used an SSL certificate issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1). Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. PhishDestroy has blocked the domain, further corroborating its fraudulent nature. Defenders should treat this domain as a confirmed phishing threat.

While the site is currently offline, its infrastructure and prior activity warrant blocking at the DNS or proxy level. Network logs should be reviewed for connections to 35.157.26.135 or the domain itself, particularly in environments where Metamask or Trezor-related services are used. No visual analysis of the page content is available, but the combination of brand impersonation, seed-phishing classification, and detection by multiple vendors confirms its malicious intent. Further investigation may reveal additional linked infrastructure or related domains.