# PhishDestroy domain threat record: 827262-trezor.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/827262-trezor.io/
Machine-readable companion: https://phishdestroy.io/domain/827262-trezor.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 11:45:27 UTC
- Last availability or vendor check: 2026-10-22 11:01:01 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 10/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Trezor

## Stored infrastructure

- Observed IP address: 172.67.146.167
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED
- Last stored HTTP status: 200
- Registration date (registry RDAP, 827262-trezor.io): 2026-09-16 20:34:35 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a11ddf-abd4-74ad-a177-359dbfaa2147/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/827262-trezor.io
- Certificate Transparency search: https://crt.sh/?q=%25.827262-trezor.io
- Web Archive lookup: https://web.archive.org/web/*/https://827262-trezor.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
827262-trezor.io is a credential phishing page that imitates Trezor, the hardware wallet maker, and targets people who own a Trezor device. A random-looking number sits in front of the brand name, so a quick glance at the address bar reads as Trezor. PhishDestroy first flagged it on 2026-10-11. As of 2026-10-19 the site is still online and serving its phishing content.

How the scam works
The page is titled "Sign in" and presents itself as a Trezor login. Trezor wallets do not need a website login to access funds, so any Trezor-branded sign-in form is a red flag. Pages like this capture whatever the visitor types, usually an email and password, and often push for a PIN or the 12 to 24 word recovery seed. Stolen credentials let attackers take over linked accounts. A recovery seed gives them full control of the wallet, which they can empty from anywhere without the physical device.

Evidence
On 2026-10-16, 10 of 92 VirusTotal engines flagged the domain, including alphaMountain.ai, BitDefender, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Kaspersky. Most engines had not caught up yet, but the vendors that did are mainstream, and other sources agree. Spamhaus lists the domain in its DBL as phishing. MetaMask and SEAL block it alongside PhishDestroy, and four AlienVault OTX threat pulses reference it.

Infrastructure
The domain was registered on 2026-09-16 through NICENIC INTERNATIONAL GROUP CO., LIMITED, 25 days before PhishDestroy detected it. A gap that short is typical of domains bought for a specific campaign. The site sits behind Cloudflare, with its visible address geolocating to Canada. That address belongs to Cloudflare's network and does not reveal where the real server runs. The Let's Encrypt certificate gives the page a padlock icon, which only means the connection is encrypted, not that the site is genuine.

What to do
If you typed a recovery seed into this page, treat the wallet as compromised. Generate a new seed on your device and move any remaining funds to the new wallet immediately. If you entered an email and password, change that password everywhere you reused it, enable app-based two-factor authentication and watch for unfamiliar sign-ins. Security teams should block the domain at DNS and proxy level, add it to mail filters, and report it to Cloudflare and the registrar for takedown.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a11ddf-abd4-74ad-a177-359dbfaa2147/
VirusTotal report: https://www.virustotal.com/gui/domain/827262-trezor.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=827262-trezor.io
Archived copy: https://web.archive.org/web/20261011114635/https://827262-trezor.io/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:52 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a11ddf-abd4-74ad-a177-359dbfaa2147.png
  Captured: 2026-10-11 11:45:27 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a11ddf-abd4-74ad-a177-359dbfaa2147.png
  Source report: https://urlscan.io/result/01a11ddf-abd4-74ad-a177-359dbfaa2147/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e1a364dc-e075-42c9-9dfc-74fbd2e5855a.png
  Captured: 2026-10-12 10:06:26 UTC
  Source report: https://radar.cloudflare.com/scan/e1a364dc-e075-42c9-9dfc-74fbd2e5855a
  SHA-256: 5b685b6fd0c356b8389e33596a40c60d2f63ca6aac5f9ec6250f109105361924

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:44Z",
        "uuid": "01a11ddf-abd4-74ad-a177-359dbfaa2147",
        "scanned_at": "2026-10-08T23:36:12Z",
        "final_url": "https://827262-trezor.io/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://827262-trezor.io/",
                "from": "http://827262-trezor.io/",
                "status": 307
            }
        ],
        "ip": "172.67.146.167",
        "domains": [
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.127.95",
            "172.67.146.167"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "3ec7e29dc4075fe262bcc3de5a50b3a7325f7718089b1ad1306adf85c2c86567",
        "script_hashes": [
            "e5dce296228005bce72db8108c8f2ce0b778768b43a2b210e83c209cbbb91909",
            "fbbbb30fc0d9a2561cd8589a7707b108b40d88d49fdc206bde697b4c80a3640a",
            "dcf730ee799bb85852bd9e49482b93b741cdcb4d800f2009e97b1aed078ffd2d",
            "0e8ae037cae7ccf10a90755fe77e60640f125007f0bf25f10f88d642533ac1f9"
        ],
        "globals": [
            "__reactRouterVersion",
            "Buffer",
            "devtoolsFormatters"
        ],
        "tls": {
            "san": [
                "*.827262-trezor.io",
                "827262-trezor.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE1",
            "subject": "827262-trezor.io",
            "protocol": "QUIC",
            "valid_to": "2026-12-15T19:44:50Z",
            "valid_from": "2026-09-16T19:44:51Z"
        },
        "domain_age_days": 22,
        "apex_age_days": 22,
        "tls_age_days": 22,
        "tls_valid_days": 89,
        "requests": 11,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 84,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:23Z",
        "uuid": "e1a364dc-e075-42c9-9dfc-74fbd2e5855a",
        "scanned_at": "2026-10-12T10:06:26Z",
        "final_url": "https://827262-trezor.io/",
        "status": 200,
        "history": [
            {
                "url": "https://827262-trezor.io/",
                "status": 200
            }
        ],
        "dom_hash": "520c38fffcc09041c5f02650cbb449a794effa41ceb957a3f30a5d085d3653e9",
        "doc_hash": "b1233f376c54fb9f042abf7616cdb191c01a2a55416cc65e67e17541d6244705",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "827262-trezor.io",
                "type": "A",
                "value": "172.67.146.167"
            },
            {
                "name": "827262-trezor.io",
                "type": "A",
                "value": "104.21.57.150"
            },
            {
                "name": "827262-trezor.io",
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:92a7"
            },
            {
                "name": "827262-trezor.io",
                "type": "AAAA",
                "value": "2606:4700:3030::6815:3996"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.146.167",
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "created": "2026-09-16T20:34:35Z",
            "updated": "2026-09-21T20:34:52Z",
            "expires": "2027-09-16T20:34:35Z",
            "nameservers": [
                "george.ns.cloudflare.com",
                "paislee.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:24Z",
        "analysis_at": "2026-10-16T18:44:06Z",
        "stats": {
            "timeout": 0,
            "harmless": 52,
            "malicious": 3,
            "suspicious": 4,
            "undetected": 33
        },
        "detections": {
            "ESET": "phishing",
            "Fortinet": "spam",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "spam",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "Sophos": "phishing and fraud",
            "alphaMountain.ai": "Spam (alphaMountain.ai)"
        },
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-09-16T20:34:35Z",
        "expires": "2027-09-16T20:34:35Z",
        "updated": "2026-09-16T20:34:35Z",
        "first_seen": "2026-09-16T22:11:32Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.57.150"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.146.167"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:92a7"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::6815:3996"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "paislee.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "george.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "george.ns.cloudflare.com"
            }
        ],
        "dns_at": "2026-10-16T18:44:58Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.827262-trezor.io",
                "827262-trezor.io"
            ],
            "issuer": "Let's Encrypt / YE1",
            "serial": "640514491e330682571a65fb9dfd1649f49",
            "sha256": "41444d1601d0d4bd7693c4ed62d7d8c4bd6138d77acd334ce34d9f0bafe1a9fe",
            "subject": "827262-trezor.io",
            "valid_to": "2026-12-15T19:44:50Z",
            "valid_from": "2026-09-16T19:44:51Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "http://www.nicenic.net",
            "created": "2026-09-16T16:00:00Z",
            "updated": "2026-09-16T16:00:00Z",
            "expires": "2027-09-16T16:00:00Z",
            "status": [
                "addPeriod",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "george.ns.cloudflare.com",
                "paislee.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client delete prohibited",
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-16T16:00:00Z",
                "registration": "2026-09-16T16:00:00Z",
                "registrar expiration": "2027-09-16T16:00:00Z",
                "last update of RDAP database": "2026-09-16T16:00:00Z"
            }
        }
    }
}
```