# PhishDestroy domain threat record: trezor.com.vc

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/trezor.com.vc/
Machine-readable companion: https://phishdestroy.io/domain/trezor.com.vc/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-30 04:40:08 UTC
- Last availability or vendor check: 2026-10-21 22:32:53 UTC
- Stored record updated: 2026-10-22 14:24:41 UTC
- VirusTotal detections in the stored snapshot: 12/89
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Trezor

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: NICENIC INTERNATIONAL GROUP CO., LIMITED

## Evidence links

- URLScan report: https://urlscan.io/result/01a04fec-340d-72f0-8e2d-2344ccb8fae1/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/trezor.com.vc
- Certificate Transparency search: https://crt.sh/?q=%25.trezor.com.vc
- Web Archive lookup: https://web.archive.org/web/*/https://trezor.com.vc/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
trezor.com.vc is an impersonation phishing page that borrows the name of Trezor, the hardware wallet maker. It sits on a Brazilian-style .com.vc ending so the address reads almost like the real brand at a glance. It targets Trezor owners and anyone looking for wallet software or support. PhishDestroy first flagged it on 2026-08-30, and it has been offline since 2026-09-13, still dead as of 2026-10-19.

How the scam works
Fake Trezor sites usually pose as a setup, firmware update or Trezor Suite download page. They then ask the visitor to type in their 12- or 24-word recovery seed, or they push a tampered app that harvests it. With the seed, the attacker can rebuild the wallet on their own device and sweep every coin it holds, and the theft cannot be reversed. The last page title served on this domain was "Suspected Phishing | Cloudflare", a provider warning screen rather than a Trezor lookalike, while our classification rests on the impersonation itself.

Evidence
Twelve of 89 VirusTotal engines flagged the domain when checked on 2026-09-13. They include BitDefender, Fortinet, Forcepoint ThreatSeeker, G-Data, alphaMountain.ai, CRDF, CyRadar and Gridinsoft. Google Safe Browsing lists it for social engineering, and urlscan.io returned a malicious verdict. Spamhaus carries it on the DBL as phishing. MetaMask and SEAL block it alongside PhishDestroy, and three AlienVault OTX threat pulses reference it, so the call is shared well beyond a single source.

Infrastructure
The domain resolved to 188.114.97.3 on Cloudflare's network, geolocated to Canada. That address belongs to Cloudflare's shared proxy, so it hides the server that actually hosted the phishing kit. The site went dark two weeks after we first spotted it, the same day the VirusTotal check ran.

What to do
If you typed your recovery seed into this site or into software downloaded from it, treat the wallet as compromised. Set up a new seed on a reset device right away and move any remaining funds to it. Trezor never asks for your seed on a website, in an app or through support. If you only connected a wallet through the page, review and revoke any token approvals it requested. Defenders should block the domain at DNS and the mail gateway, and should watch for sibling Trezor lookalikes on other country-code endings.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a04fec-340d-72f0-8e2d-2344ccb8fae1/
VirusTotal report: https://www.virustotal.com/gui/domain/trezor.com.vc
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trezor.com.vc
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:25:35 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a04fec-340d-72f0-8e2d-2344ccb8fae1.png
  Captured: 2026-08-30 04:40:08 UTC
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04e42-c739-7664-8adc-52978a966fd6.png
  Captured: 2026-08-29 16:03:20 UTC
  Source report: https://urlscan.io/result/01a04e42-c739-7664-8adc-52978a966fd6/
  SHA-256: b1c68e057bf69a0a88fec37e880caac74e28b995e5abdefa96d0252efa0e3b13
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04e45-823e-7528-94a1-f33a546a26cf.png
  Captured: 2026-08-29 16:06:47 UTC
  Source report: https://urlscan.io/result/01a04e45-823e-7528-94a1-f33a546a26cf/
  SHA-256: 63107e5a2d1a05e30c8e6fd6e40a00d9655454514b663aae7a6f8b8fe1231ae8
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04efb-113c-7646-9fb0-b64b52b338c1.png
  Captured: 2026-08-29 19:25:06 UTC
  Source report: https://urlscan.io/result/01a04efb-113c-7646-9fb0-b64b52b338c1/
  SHA-256: bedcdf143e07d52806e83e0dddeec23ef3a744dc7694e5a02fc4312a7d80a0bb
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04efb-1a57-7716-8562-2698fda961a9.png
  Captured: 2026-08-29 19:25:08 UTC
  Source report: https://urlscan.io/result/01a04efb-1a57-7716-8562-2698fda961a9/
  SHA-256: 0dc6fe173f6790abfdc3765524a2619105ffea0ffbb2342dd59242b9520616b0
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04f05-814f-71d0-9ac6-73c708e935d1.png
  Captured: 2026-08-29 19:36:31 UTC
  Source report: https://urlscan.io/result/01a04f05-814f-71d0-9ac6-73c708e935d1/
  SHA-256: 66774b9660439cba85b72b8d68b7d84316bf1633a4a3275447ffe687439362ee
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04f0a-7bd0-7389-ada2-afac769e02ec.png
  Captured: 2026-08-29 19:41:56 UTC
  Source report: https://urlscan.io/result/01a04f0a-7bd0-7389-ada2-afac769e02ec/
  SHA-256: ac4d22d9433ccb0616e64e46035402147cd6e9828d3a6171bf9660ef97627f59

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:17:03Z",
        "uuid": "01a04fec-340d-72f0-8e2d-2344ccb8fae1",
        "scanned_at": "2026-08-29T23:48:29Z",
        "final_url": "https://trezor.com.vc/",
        "status": 403,
        "ip": "188.114.97.3",
        "domains": [
            "challenges.cloudflare.com"
        ],
        "ips": [
            "104.18.95.41",
            "104.18.94.41",
            "188.114.97.3"
        ],
        "asns": [
            "13335"
        ],
        "link_domains": [
            "www.cloudflare.com"
        ],
        "doc_hash": "d59283d9a702792c8ad44872c4ec3088875e6844940bbc8e2380cd878216936c",
        "globals": [
            "onTurnstileSuccess",
            "_cf_translation",
            "turnstile",
            "singleSelectors",
            "groupSelectors"
        ],
        "tls": {
            "san": [
                "trezor.com.vc",
                "*.trezor.com.vc"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "trezor.com.vc",
            "protocol": "QUIC",
            "valid_to": "2026-11-27T15:47:54Z",
            "valid_from": "2026-08-29T14:50:09Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 90,
        "requests": 6,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "genericcloudflare"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Generic Cloudflare"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-frame-options": "SAMEORIGIN",
            "referrer-policy": "same-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:27:19Z",
        "uuid": "37a97601-6686-4492-9550-efd27dd8aae0",
        "scanned_at": "2026-09-13T09:54:15Z"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T13:27:11Z",
        "analysis_at": "2026-09-25T06:23:55Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "PhishFort": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
        "created": "2026-08-29T15:40:48Z",
        "expires": "2027-08-29T15:40:48Z",
        "updated": "2026-08-29T15:40:48Z",
        "first_seen": "2026-08-29T16:01:36Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3037::ac43:99e3"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:ce9"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "jeremy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.153.227"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "monroe.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "jeremy.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.12.233"
            }
        ],
        "dns_at": "2026-09-01T07:45:14Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "trezor.com.vc",
                "*.trezor.com.vc"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "23a970618cc82cb3138a1443253d0f7a",
            "sha256": "f545d1e576e0df0f44cb5478f22805a5ea6e8477b0dd52cbfc2b222cba6ebcb8",
            "subject": "trezor.com.vc",
            "valid_to": "2026-11-27T15:47:54Z",
            "valid_from": "2026-08-29T14:50:09Z"
        },
        "whois": {
            "registrar": "NICENIC INTERNATIONAL GROUP CO., LIMITED",
            "registrar_iana_id": "3765",
            "registrar_url": "http://www.nicenic.net",
            "created": "2026-08-28T16:00:00Z",
            "updated": "2026-08-28T16:00:00Z",
            "expires": "2027-08-28T16:00:00Z",
            "status": [
                "addPeriod",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "jeremy.ns.cloudflare.com",
                "monroe.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```