ChainPatrol
Web-Check 
SOCRadar 
LeakIX 
Domain security and threat intelligence
trezor49[.]vip
“exchange”
Threat verdict
High
69/100 evidence score
Availability
Unverified
Current reachability is unverified
Risk signals
VirusTotal detections: 3/94
Spamhaus DBL: DBL_SPAM
URLQuery threat systems: 4 alerts
Brand impersonation: Trezor
Evidence Summary
HIGH
This domain, www.trezor49.vip, is identified as cryptocurrency wallet phishing infrastructure targeting Trezor, a hardware wallet provider. The site is currently offline, though prior analysis confirms its role in brand impersonation designed to deceive users into divulging sensitive credentials or financial information. The domain was operational long enough to be assessed and subsequently blocked by security mechanisms. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on March 7, 2026, through Gname.com Pte. Ltd., and resolved to the IP address 202.95.1.30. Security vendors flagged the domain in 13 of 95 VirusTotal scans, placing it on one security blocklist. The site employed a Let's Encrypt SSL certificate and utilized technologies such as amCharts, Bootstrap, Vue.js, Nginx, Cloudflare, Swiper, jQuery, and HSTS. A Gridinsoft trust score of 0/100 further corroborates its classification as high-risk infrastructure. The domain is currently offline, but its prior activity warrants continued monitoring. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with the site should immediately revoke any credentials or recovery phrases entered, monitor financial accounts for unauthorized activity, and consider hardware wallet integrity checks. Security teams should update detection rules to include this domain and its indicators of compromise in threat intelligence feeds.
VirusTotal
3 det.
URLQuery
4 threat alerts
URLScan
TLS Certificate
Expired or unverified -75d
Age
5 mo
Observed status
Unverified
DestroyList
Listed
Data coverage
VirusTotal
3 / 94
URLQuery
4 threat-system alerts
PhishStats
checked — no match recorded
OTX
no community references
CF Radar
scan completed
URLScan capture
stored report
URLScan verdict
Analysis completed
DNS blocks
not checked
TLS
Expired or unverified
WHOIS
5 mo old
Screenshot
3 captures · 3 sources
Redirect chain
not probed
Network Security Intelligence
| Detection System | Indicator | Verdict | Alert |
|---|---|---|---|
| Hagezi Threat Feed | www.trezor49.vip |
malicious | Sinkholed |
| Hagezi Threat Feed | ht.trezor49.vip |
malicious | Sinkholed |
| Hagezi Threat Feed | admin.trezor82.cz |
malicious | Sinkholed |
| DNS4EU | admin.trezor82.cz |
malicious | Sinkholed |
Threat Response Pipeline
Discovery
Checks
Reports
Availability
15/17
Public Blocklist Status
Stored Capture
Domain Intelligence
Domain
URLScan Verdict
Analysis completed
score 0 report ↗
Server / ASN
nginx · AS152194 CTGSERVERLIMITED-AS-AP CTG Server Limited, HK
IP Reputation
abuse score 0/100 0 reports checked Jul 27, 2026
Registrar
Gname
(SG)
(SG)
IP Address
202.95.1.30
RegistrationCreated Mar 7, 2026 (159d)
Technical detailsDNS, SSL SANs, timestamps
First DetectedMar 7, 2026
DOM Analysisanalyzed Mar 24, 2026score 0/100
IoC Extractionscanned Jul 29, 20260 wallet · 0 Telegram IoCs
Submitted URLhttps://www.trezor49.vip/
Nameserversa3.share-dns.com
TLS Fingerprint
TLS Observationvalid from Mar 2, 2026scanned Mar 15, 2026
Case ID
ICANN OVERSIGHT
Accreditation and RAA context
Accreditation and RAA context
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accreditation is a contract, not a safety seal.
Verify ICANN fees
Read RAA §3.18
PHISHDESTROY INVESTIGATIONICANN funding, contracts, and DNS abuse oversight
Technologies · 10 identified
A
amCharts
JavaScript graphics
amCharts is a JavaScript-based interactive charts and maps programming library and tool.
amcharts.com 100% confidence
B
Bootstrap
UI frameworks
Bootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
getbootstrap.com 100% confidence
V
Vue.js
JavaScript frameworks
Vue.js is an open-source model–view–viewmodel JavaScript framework for building user interfaces and single-page applications.
vuejs.org 100% confidence
N
Nginx
Web servers
Reverse proxies
Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.
nginx.org 100% confidence
Cloudflare
CDN
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.com 100% confidence
S
Swiper
JavaScript libraries
Swiper is a JavaScript library that creates modern touch sliders with hardware-accelerated transitions.
swiperjs.com 100% confidence
J
jQuery
JavaScript libraries
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.com 100% confidence
H
HSTS
Security
HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org 100% confidence
C
cdnjs
CDN
P
Popper
Miscellaneous
Popper is a positioning engine, its purpose is to calculate the position of an element to make it possible to position it near a given reference element.
popper.js.org 100% confidence
Detected via Cloudflare Radar · Wappalyzer engine
Report This Domain
Submit evidence & help protect others
VirusTotal Analysis
3 / 94 security vendors flagged this domain
View on VT
Last analyzed
alphaMountain.ai
Ermes
Fortinet
Archived Evidence
Wayback Machine Snapshot
A historical snapshot is available for evidence review
Evidence & External Reports
Security Analysis
OSINT & Intelligence
DNS & Network
SEO & Domain
Were You Affected by This Site?
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Action Fraud
Report fraud and cybercrime in England, Wales and Northern Ireland
Contact centre0300 123 2040
PhishDestroy listing review Not a law-enforcement report
Domain Appeal
Request a review if you own this domain and believe the listing is incorrect
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials. Learn more about recovery fraud →
Report to Your Local Authorities
Select your country to get official cybercrime contacts, or create a complaint draft →.
97-country directory
Template-based draft • optional AI wording assistance requires separate consent
Review and submit it yourself
Related Infrastructure & Reports
Same registrar: Gname 6
tokeimng.fit Trezor impersonation 8
These domains also target Trezor users. View all Trezor threats →
trezorsuite.at Recent threat reports 6
Recently added threat reports.
ditchenko.ru 
Check Any Domain
Threat analysis using stored blocklist, WHOIS, DNS, and public scan evidence
Scan NowReport Phishing
Submit suspicious domains to our threat database — protect the community
ReportLive Threat Feed
Recent phishing reports and observed availability changes
MonitorStay Informed, Stay Safe
Monitor live threats or contest this listing if you believe it's a false positive