# PhishDestroy domain threat record: support-wallet-trzzr.gitbook.io

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/support-wallet-trzzr.gitbook.io/
Machine-readable companion: https://phishdestroy.io/domain/support-wallet-trzzr.gitbook.io/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-12 04:40:09 UTC
- Last availability or vendor check: 2026-10-22 10:06:53 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 9/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: trezor

## Stored infrastructure

- Observed IP address: 172.64.147.209
- Registrar in stored WHOIS data: GitBook
- Last stored HTTP status: 307
- Registration date (registry RDAP, gitbook.io): 2014-03-30 06:09:09 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0bc53-cbb4-754f-98af-8abde7d0c5b0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/support-wallet-trzzr.gitbook.io
- Certificate Transparency search: https://crt.sh/?q=%25.support-wallet-trzzr.gitbook.io
- Web Archive lookup: https://web.archive.org/web/*/https://support-wallet-trzzr.gitbook.io/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
support-wallet-trzzr.gitbook.io is an impersonation phishing page posing as official Trezor support, built to catch owners of Trezor hardware wallets. It sits on a GitBook documentation subdomain, so the address borrows the credibility of a legitimate publishing platform while the misspelled "trzzr" stands in for the brand. PhishDestroy first detected it on 2026-09-12. As of 2026-10-19 the site was still online and its content was redirecting visitors elsewhere.

How the scam works
The page is titled "Trezor® Wallet® | The Next Generation* of Hardware", and the stray trademark symbols and asterisks are a hallmark of hastily assembled copycat pages. Fake Trezor support sites like this one typically steer users toward a "wallet recovery", "sync" or "update" step that asks for the 12- or 24-word recovery seed. Anyone who types that phrase into the page gives the operator full control of the wallet. The attacker can then empty it from any device, and the transfer cannot be reversed. A genuine Trezor device never needs its seed entered on a website.

Evidence
On VirusTotal, 9 of 89 engines flagged the page as of 2026-09-21. The engines that flagged it include alphaMountain.ai, BitDefender, Fortinet, G-Data, Kaspersky, Lionic, Netcraft and OpenPhish. A minority score like this is normal for a freshly published phishing subdomain, but the list carries weight because it mixes antivirus vendors with phishing-focused feeds. urlscan.io rated the page malicious and independently identified Trezor as the brand being imitated. The domain is listed on the PhishDestroy blocklist.

Infrastructure
The 2014-03-30 registration date and the GitBook registrar belong to the gitbook.io platform domain, not to the scammer. This operation simply created a free subdomain on a trusted service instead of buying its own domain. Traffic is served through Cloudflare, Inc. from an address geolocated to Canada, and the TLS certificate comes from Google Trust Services. Every piece of this setup is shared, legitimate infrastructure, so the padlock and the gitbook.io address say nothing about who actually runs the page.

What to do
If you entered your recovery phrase on this page, treat the wallet as compromised. Set up a new wallet with a freshly generated seed on your Trezor and move any remaining funds to it immediately. Never reuse the exposed phrase, and ignore follow-up "support" messages offering to recover stolen coins. If you only visited the page, close it and get Trezor software and help solely through channels you reach yourself. Security teams should block the subdomain, watch for similar Trezor lookalikes on documentation-hosting platforms, and report the page to GitBook for removal.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0bc53-cbb4-754f-98af-8abde7d0c5b0/
VirusTotal report: https://www.virustotal.com/gui/domain/support-wallet-trzzr.gitbook.io
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=support-wallet-trzzr.gitbook.io
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:44:04 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0bc53-cbb4-754f-98af-8abde7d0c5b0.png
  Captured: 2026-09-12 04:40:09 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0bc53-cbb4-754f-98af-8abde7d0c5b0.png
  Source report: https://urlscan.io/result/01a0bc53-cbb4-754f-98af-8abde7d0c5b0/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/471aa1e4-3bba-4a97-b655-53631e201b49.png
  Captured: 2026-09-19 01:11:01 UTC
  Source report: https://radar.cloudflare.com/scan/471aa1e4-3bba-4a97-b655-53631e201b49
  SHA-256: f3ca5c1734a9d77392eaf418740b2476208a6852a118ceecf30afea40cff6a02
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bc53-c7e8-71f7-aaa3-00a24afe283f.png
  Captured: 2026-09-20 01:00:09 UTC
  Source report: https://urlscan.io/result/01a0bc53-c7e8-71f7-aaa3-00a24afe283f/
  SHA-256: 199144c1edfb1e78c29a3bc251e191301e1bbbc733f457c5884ad8505d38ce29
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0becc-8e73-7612-9b6a-6819e8d918b4.png
  Captured: 2026-09-20 12:31:20 UTC
  Source report: https://urlscan.io/result/01a0becc-8e73-7612-9b6a-6819e8d918b4/
  SHA-256: c560bae6f6ac9b9ac743679f125b889144b45375989eca19d030419004b65114
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0d09f-3f6b-743d-9b28-925604d189b1.png
  Captured: 2026-09-23 23:34:58 UTC
  Source report: https://urlscan.io/result/01a0d09f-3f6b-743d-9b28-925604d189b1/
  SHA-256: 7244ad27bb0bcbd8cf8d7d48db35127c724630eb2e93feb7e819692737052d71
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d855-f7ef-77c3-a129-859e06969a2c.png
  Captured: 2026-09-25 11:31:53 UTC
  Source report: https://urlscan.io/result/01a0d855-f7ef-77c3-a129-859e06969a2c/
  SHA-256: 7244ad27bb0bcbd8cf8d7d48db35127c724630eb2e93feb7e819692737052d71
- URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d855-f68b-70b2-8a07-efe0389ccaec.png
  Captured: 2026-09-25 11:31:53 UTC
  Source report: https://urlscan.io/result/01a0d855-f68b-70b2-8a07-efe0389ccaec/
  SHA-256: 7244ad27bb0bcbd8cf8d7d48db35127c724630eb2e93feb7e819692737052d71

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:28:27Z",
        "uuid": "01a0bc53-cbb4-754f-98af-8abde7d0c5b0",
        "scanned_at": "2026-09-20T01:00:13Z",
        "final_url": "https://support-wallet-trzzr.gitbook.io/us",
        "status": 200,
        "ip": "172.64.147.209",
        "domains": [
            "static-2c.gitbook.com",
            "app.gitbook.com"
        ],
        "ips": [
            "172.64.146.167",
            "172.64.147.209"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.gitbook.com"
        ],
        "doc_hash": "217824a25a90fbda11baa594b7a8e6ce95630e0634abd885a55fb33bb6d2b252",
        "globals": [
            "__next_f",
            "webpackChunk_N_E",
            "_N_E",
            "next",
            "_N_E_STYLE_LOAD",
            "GitBook",
            "__gitbookScrollPageInitialLoadHandled"
        ],
        "cookies": [
            "__session",
            "GAESA"
        ],
        "storage_keys": [
            "nuqs-localStorage-test",
            "gitbook-space-navigation:last",
            "__session_updated",
            "__gitbook_session"
        ],
        "tls": {
            "san": [
                "gitbook.io",
                "*.gitbook.io"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "gitbook.io",
            "protocol": "QUIC",
            "valid_to": "2026-12-13T23:02:54Z",
            "valid_from": "2026-09-14T22:03:00Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 5,
        "tls_valid_days": 90,
        "requests": 37,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "trezor"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Trezor"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "strict-transport-security": "max-age=31536000",
            "content-security-policy": "default-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; style-src 'self' 'unsafe-inline' blob: *; img-src * 'self' blob: data:; connect-src *; font-src *; frame-src *; object-src 'non",
            "x-content-type-options": "nosniff",
            "referrer-policy": "no-referrer-when-downgrade"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:34:15Z",
        "uuid": "471aa1e4-3bba-4a97-b655-53631e201b49",
        "scanned_at": "2026-09-19T01:11:01Z",
        "final_url": "https://support-wallet-trzzr.gitbook.io/us",
        "status": 200,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://support-wallet-trzzr.gitbook.io/",
                "status": 307
            },
            {
                "url": "https://support-wallet-trzzr.gitbook.io/",
                "status": 307
            },
            {
                "url": "https://support-wallet-trzzr.gitbook.io/us/",
                "status": 302
            },
            {
                "url": "https://support-wallet-trzzr.gitbook.io/us",
                "status": 200
            }
        ],
        "dom_hash": "80fd601a62f4a159c38eca74a0fff1021533dd2aab9a21aafbc73864f20e09fa",
        "doc_hash": "b0edc85eeaffe0347e10af0f7583d09604dc622308c09e9013f807028020c97f",
        "phishing_v2": [
            "phishing"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "support-wallet-trzzr.gitbook.io",
                "type": "A",
                "value": "104.18.40.47"
            },
            {
                "name": "support-wallet-trzzr.gitbook.io",
                "type": "A",
                "value": "172.64.147.209"
            },
            {
                "name": "support-wallet-trzzr.gitbook.io",
                "type": "AAAA",
                "value": "2a06:98c1:310d::6812:282f"
            },
            {
                "name": "support-wallet-trzzr.gitbook.io",
                "type": "AAAA",
                "value": "2606:4700:4401::ac40:93d1"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.18.40.47",
        "whois": {
            "registrar": "Cloudflare, Inc",
            "created": "2014-03-30T06:09:09Z",
            "updated": "2026-08-12T02:09:29Z",
            "expires": "2031-03-30T06:09:09Z",
            "nameservers": [
                "hugh.ns.cloudflare.com",
                "dahlia.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T06:15:27Z",
        "analysis_at": "2026-09-22T05:00:03Z",
        "stats": {
            "timeout": 0,
            "harmless": 50,
            "malicious": 10,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "Ermes": "not recommended",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "PhishFort": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Cloudflare, Inc",
        "created": "2014-03-30T06:09:09Z",
        "expires": "2031-03-30T06:09:09Z",
        "updated": "2026-08-12T02:09:29Z",
        "first_seen": "2026-09-11T20:36:36Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.18.40.47"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2a06:98c1:310d::6812:282f"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.64.147.209"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "pki.goog"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "digicert.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:4401::ac40:93d1"
            },
            {
                "ttl": 300,
                "type": "CAA",
                "value": "letsencrypt.org"
            }
        ],
        "dns_at": "2026-09-22T05:05:25Z",
        "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "gitbook.io",
                "*.gitbook.io"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "7e2ef8ff41e512cc133800ba73ca362e",
            "sha256": "f3e0d20bcdcb0f6afa89f62c0f4ef0ea0ddd7a7445d5cc7ae8b2e212568ea348",
            "subject": "gitbook.io",
            "valid_to": "2026-12-13T23:02:54Z",
            "valid_from": "2026-09-14T22:03:00Z"
        },
        "whois": {
            "registrar": "Cloudflare, Inc",
            "registrar_iana_id": "1910",
            "registrar_url": "http://cloudflare.com",
            "created": "2014-03-30T06:09:09Z",
            "updated": "2026-08-12T02:09:29Z",
            "expires": "2031-03-30T06:09:09Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "dahlia.ns.cloudflare.com",
                "hugh.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```