# PhishDestroy domain threat record: trezor.wallet.org.ph Content language: English Canonical HTML report: https://phishdestroy.io/domain/trezor.wallet.org.ph/ Machine-readable companion: https://phishdestroy.io/domain/trezor.wallet.org.ph/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-25 15:56:51 UTC - Last availability or vendor check: 2026-10-22 10:33:55 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 10/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trezor ## Stored infrastructure - Observed IP address: 104.26.9.49 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 403 ## Evidence links - URLScan report: https://urlscan.io/result/01a03825-b803-72b8-8f1f-597cb1ccded2/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/trezor.wallet.org.ph - Certificate Transparency search: https://crt.sh/?q=%25.trezor.wallet.org.ph - Web Archive lookup: https://web.archive.org/web/*/https://trezor.wallet.org.ph/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview trezor.wallet.org.ph is an impersonation phishing site that uses the Trezor brand to target owners of Trezor hardware wallets. It puts the brand name at the front of a Philippine wallet.org.ph address, so a hurried reader sees "trezor" and "wallet" and assumes it is official. PhishDestroy first flagged it on 2026-08-25, and it was still online on 2026-10-19, with its content served behind a protection layer. How the scam works Fake Trezor pages usually claim the device needs a firmware update, a security check or a wallet "recovery." They then ask the victim to type the 12- or 24-word recovery seed into a web form. Whoever holds that seed controls the wallet, so the attacker can rebuild it elsewhere and empty it without ever touching the physical device. The page title currently reads "Attention Required! | Cloudflare," which is a Cloudflare challenge screen rather than Trezor branding, while we classify the site as Trezor impersonation. Evidence On 2026-10-07, 10 of 92 VirusTotal engines flagged the domain. Detections came from alphaMountain.ai, BitDefender, CRDF, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and PhishFort. PhishFort specializes in crypto-brand protection, so its verdict carries particular weight here. Spamhaus lists the domain in its DBL with the DBL_PHISH tag, which mail filters and DNS resolvers use to block it, and it is on the PhishDestroy blocklist. Infrastructure The site resolves to 104.26.9.49 on Cloudflare's network, geolocated to Canada. That means the address belongs to Cloudflare's shared front end, not to whoever actually runs the page. Its HTTPS certificate comes from Google Trust Services (WE1), the routine automated certificate for this kind of setup. The padlock in the browser says nothing about whether the site is genuine. What to do Trezor never asks for your recovery seed on a website, in an app form or by message. If you typed your seed into this site, treat the wallet as compromised. Set up your Trezor again with a freshly generated seed and move all funds to the new addresses immediately. If you downloaded any "Trezor" software from this domain, remove it and scan the machine. Defenders should block the hostname at the DNS, proxy and mail layers, and report it to Cloudflare and Trezor's security team. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a03825-b803-72b8-8f1f-597cb1ccded2/ VirusTotal report: https://www.virustotal.com/gui/domain/trezor.wallet.org.ph Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trezor.wallet.org.ph Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:56:22 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a03825-b803-72b8-8f1f-597cb1ccded2.png Captured: 2026-08-25 15:56:51 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a03825-b803-72b8-8f1f-597cb1ccded2.png Captured: 2026-08-25 17:08:06 UTC Source report: https://urlscan.io/result/01a03825-b803-72b8-8f1f-597cb1ccded2/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:32:20Z", "uuid": "01a03825-b803-72b8-8f1f-597cb1ccded2", "scanned_at": "2026-08-25T08:59:57Z", "final_url": "https://trezor.wallet.org.ph/", "status": 403, "ip": "172.67.74.162", "ips": [ "172.67.74.162" ], "asns": [ "13335" ], "link_domains": [ "www.cloudflare.com" ], "doc_hash": "1964624430ec55ef357ec38161c46adfd953173e3706214e1c94e193b125c55c", "script_hashes": [ "4e4a845231637906eae640214acce62f08e845c97b3d0d8823ed7eef5358cb30" ], "globals": [ "_cf_translation" ], "cookies": [ "cf_clearance" ], "tls": { "san": [ "wallet.org.ph", "*.wallet.org.ph" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "wallet.org.ph", "protocol": "TLS 1.3", "valid_to": "2026-10-01T06:07:54Z", "valid_from": "2026-07-03T05:07:58Z" }, "domain_age_days": 53, "apex_age_days": 74, "tls_age_days": 53, "tls_valid_days": 90, "requests": 7, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 64, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-frame-options": "SAMEORIGIN", "referrer-policy": "same-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T05:59:47Z", "uuid": "f6d7234f-a921-4348-b68d-f5687b8cad9a", "scanned_at": "2026-08-25T16:01:47Z", "final_url": "https://trezor.wallet.org.ph/", "status": 403, "redirected": "https-only", "history": [ { "url": "http://trezor.wallet.org.ph/", "status": 307 }, { "url": "https://trezor.wallet.org.ph/", "status": 403 } ], "dom_hash": "e1e0ec04ba2dccd9143717ccf431a0c9d267fac4083951806a2652b5fb5fcf8d", "doc_hash": "d7b615dcc6a766eba0064deb5585a1e162def32682f900db43c83f6278f4e12a", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "trezor.wallet.org.ph", "type": "A", "value": "104.26.9.49" }, { "name": "trezor.wallet.org.ph", "type": "A", "value": "104.26.8.49" }, { "name": "trezor.wallet.org.ph", "type": "A", "value": "172.67.74.162" }, { "name": "trezor.wallet.org.ph", "type": "AAAA", "value": "2606:4700:20::681a:931" }, { "name": "trezor.wallet.org.ph", "type": "AAAA", "value": "2606:4700:20::681a:831" }, { "name": "trezor.wallet.org.ph", "type": "AAAA", "value": "2606:4700:20::ac43:4aa2" } ], "dnssec_valid": false, "ip": "104.26.9.49" } } ```