# PhishDestroy domain threat record: trezor-uk.at

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/trezor-uk.at/
Machine-readable companion: https://phishdestroy.io/domain/trezor-uk.at/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 09:44:38 UTC
- Last availability or vendor check: 2026-10-22 10:33:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Trezor

## Stored infrastructure

- Observed IP address: 172.67.177.26
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 403
- Registration date in stored WHOIS data: 2026-09-29 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a120f3-f5cd-775a-9b11-fec945ec4a4f/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/trezor-uk.at
- Certificate Transparency search: https://crt.sh/?q=%25.trezor-uk.at
- Web Archive lookup: https://web.archive.org/web/*/https://trezor-uk.at/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
trezor-uk.at poses as a Trezor site under an Austrian domain with a misleading "uk" label, aimed at owners of Trezor hardware wallets. PhishDestroy first flagged it on 2026-10-11. As of 2026-10-19 the site was still online, with its content sitting behind a Cloudflare protection layer. The page currently shows the title "Attention Required! | Cloudflare", a Cloudflare challenge screen, while our classification is Trezor impersonation phishing.

How the scam works
Fake Trezor sites usually claim the visitor's device needs a firmware update, a security check or wallet recovery. They then ask for the 12- or 24-word recovery seed, or they offer a tampered copy of the Trezor Suite app. A hardware wallet only protects funds while the seed stays offline. Anyone who types those words into a website gives the attacker full control of every account derived from it. The theft happens on the attacker's own device and needs no further approval from the victim, so the funds are usually swept within minutes.

Evidence
Six of 92 VirusTotal engines flagged the domain on 2026-10-12: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Fortinet, Gridinsoft and SOCRadar. That count is modest, so many security products may still let the site through. Spamhaus lists the domain in its DBL under the phishing category, and the MetaMask and SEAL blocklists carry it alongside PhishDestroy. Four AlienVault OTX threat pulses also reference it, so other researchers have tracked the same activity.

Infrastructure
The domain resolves to Cloudflare, Inc. address space registered in Canada. That address belongs to Cloudflare's reverse proxy and does not reveal where the real server runs. The interstitial challenge page shown to visitors comes from the same Cloudflare front end.

What to do
If you entered your recovery seed on this site, treat that wallet as compromised. Set up a new Trezor seed on a reset or replacement device and move any remaining funds to the new addresses right away. If you downloaded software from the page, uninstall it and get Trezor Suite only through Trezor's official channels. Remember that Trezor never asks for your seed online. Security teams should block the domain at DNS and proxy level, add it to mail and web filters, and warn staff and customers who hold Trezor devices.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a120f3-f5cd-775a-9b11-fec945ec4a4f/
VirusTotal report: https://www.virustotal.com/gui/domain/trezor-uk.at
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trezor-uk.at
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:50 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a120f3-f5cd-775a-9b11-fec945ec4a4f.png
  Captured: 2026-10-11 09:44:38 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/416a9180-c6f6-4e7a-b1c0-8da4313df041.png
  Captured: 2026-10-12 10:29:23 UTC
  Source report: https://radar.cloudflare.com/scan/416a9180-c6f6-4e7a-b1c0-8da4313df041
  SHA-256: 253edd2168205d24112dd6889c8814c5d35fbabe053f823bdf507caba752bafc
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a128e2-68ed-72ca-a8b0-fe3c612e7790.png
  Captured: 2026-10-11 02:54:59 UTC
  Source report: https://urlscan.io/result/01a128e2-68ed-72ca-a8b0-fe3c612e7790/
  SHA-256: 9fa67864a1b1d11aad81cde5f6c34e750f41158aca113518afff7231ddf673ee
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12caa-6f94-7487-b1e8-32ae3c3a8769.png
  Captured: 2026-10-11 20:32:20 UTC
  Source report: https://urlscan.io/result/01a12caa-6f94-7487-b1e8-32ae3c3a8769/
  SHA-256: 9fa67864a1b1d11aad81cde5f6c34e750f41158aca113518afff7231ddf673ee
- URLScan · 2026-10-15: https://screenshots.phishdestroy.io/us/01a141b1-bed9-76ec-87ea-11e321bce69f.png
  Captured: 2026-10-15 22:32:20 UTC
  Source report: https://urlscan.io/result/01a141b1-bed9-76ec-87ea-11e321bce69f/
  SHA-256: 9fa67864a1b1d11aad81cde5f6c34e750f41158aca113518afff7231ddf673ee
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a1545f-9e3f-75bf-99aa-dc73aa359698.png
  Captured: 2026-10-19 13:35:25 UTC
  Source report: https://urlscan.io/result/01a1545f-9e3f-75bf-99aa-dc73aa359698/
  SHA-256: b633b46de0ebe87c90aef644e333d5e773ffe7b5c30468a097839ab02c1a3631
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a15670-47dc-7481-a6bf-8e9b3ef1f1f0.png
  Captured: 2026-10-19 23:12:52 UTC
  Source report: https://urlscan.io/result/01a15670-47dc-7481-a6bf-8e9b3ef1f1f0/
  SHA-256: b633b46de0ebe87c90aef644e333d5e773ffe7b5c30468a097839ab02c1a3631

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:29Z",
        "uuid": "01a120f3-f5cd-775a-9b11-fec945ec4a4f",
        "scanned_at": "2026-10-09T13:57:11Z",
        "final_url": "https://trezor-uk.at/",
        "globals": [
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass",
            "reloadButtonClick",
            "downloadButtonClick",
            "detailsButtonClick",
            "setAutoFetchState"
        ],
        "domain_age_days": 9,
        "apex_age_days": 9,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 15,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:17Z",
        "uuid": "416a9180-c6f6-4e7a-b1c0-8da4313df041",
        "scanned_at": "2026-10-12T10:29:23Z",
        "final_url": "https://trezor-uk.at/",
        "status": 403,
        "history": [
            {
                "url": "https://trezor-uk.at/",
                "status": 403
            }
        ],
        "dom_hash": "11a3897f82dd5c71e053fdd08f745dfed630a911694965172c89e6f17585f6c3",
        "doc_hash": "185ffe33507e6c2141e9365c9532e36d10c04db76b2efcd0acf3d443785f91a4",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "trezor-uk.at",
                "type": "A",
                "value": "172.67.177.26"
            },
            {
                "name": "trezor-uk.at",
                "type": "A",
                "value": "104.21.96.112"
            },
            {
                "name": "trezor-uk.at",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:6070"
            },
            {
                "name": "trezor-uk.at",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:b11a"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.177.26",
        "whois": {
            "registrar": "Hosting concepts B.V. / Registrar.eu ( https://nic.at/registrar/648 )",
            "created": "2026-09-30T10:40:52Z",
            "updated": "2026-09-30T10:47:45Z",
            "nameservers": [
                "junade.ns.cloudflare.com",
                "ulla.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:14Z",
        "analysis_at": "2026-10-20T00:18:57Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 12,
            "suspicious": 2,
            "undetected": 33
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "Seclookup": "malicious",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-09-30T00:00:00Z",
        "first_seen": "2026-09-30T09:46:54Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ulla.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::6815:6070"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "junade.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:b11a"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.177.26"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "junade.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.96.112"
            }
        ],
        "dns_at": "2026-10-20T00:19:13Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "trezor-uk.at",
                "www.trezor-uk.at",
                "*.www.trezor-uk.at"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "a09548c57fe6d37e0e3167e07eabb633",
            "sha256": "6ab98e7528d14b1e2c19454d8897a7dc8486eb3632efc63e5f4059156b575b9c",
            "subject": "trezor-uk.at",
            "valid_to": "2026-12-29T09:05:57Z",
            "valid_from": "2026-09-30T08:06:03Z"
        },
        "whois": []
    }
}
```