# PhishDestroy domain threat record: trezorauthentication.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/trezorauthentication.com/ Machine-readable companion: https://phishdestroy.io/domain/trezorauthentication.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-03 19:08:19 UTC - Last availability or vendor check: 2026-10-22 10:21:25 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 9/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Trezor ## Stored infrastructure - Observed IP address: 74.208.236.56 - Registrar in stored WHOIS data: IONOS SE - Registrar country in stored WHOIS data: DE - Last stored HTTP status: 200 - Registration date (registry RDAP, trezorauthentication.com): 2026-09-30 18:42:40 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0f661-9966-713f-9f8e-13b58329dda3/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/trezorauthentication.com - Certificate Transparency search: https://crt.sh/?q=%25.trezorauthentication.com - Web Archive lookup: https://web.archive.org/web/*/https://trezorauthentication.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview trezorauthentication.com is an impersonation phishing page posing as Trezor, the hardware wallet maker, and it targets people who keep crypto on a Trezor device. The domain name suggests an official authentication or device-check step, which Trezor does not run through a separate website. PhishDestroy first detected it on 2026-10-03. As of 2026-10-19 the site was still online and serving its content. How the scam works Fake Trezor sites usually tell visitors that their device needs to be authenticated, verified or updated, then ask them to type in their 12- or 24-word recovery seed. That seed is the master key to the wallet. Anyone who holds it can recreate the wallet on their own device and empty it, without the physical Trezor and without the PIN. A genuine Trezor device never asks you to enter your seed on a website, so any page that does is stealing it. Evidence On 2026-10-07, 9 of 92 VirusTotal engines flagged the domain. The flagging vendors include BitDefender, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky and SOCRadar. That count is modest, but it comes from several unrelated security vendors and points the same way. The domain also appears on the MetaMask and SEAL blocklists alongside PhishDestroy's own, and it is referenced in one AlienVault OTX threat pulse. Infrastructure The domain was registered on 2026-09-30, three days before PhishDestroy caught it. That short gap is typical of throwaway phishing domains set up to be used quickly. Registration went through IONOS SE, and the site is hosted on IONOS's network at an address located in the United States. It was still live more than two weeks after first detection. What to do If you entered your recovery seed on this site, treat that wallet as fully compromised. Set up a new Trezor wallet with a freshly generated seed on your device and move all remaining funds there immediately. If you also connected a software wallet, revoke any token approvals you granted. If you only browsed the page and typed nothing, no action is needed beyond closing it. Defenders should block the domain at DNS and web proxies and add it to mail and chat filters. Report it to IONOS SE as the registrar and host so the takedown can proceed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0f661-9966-713f-9f8e-13b58329dda3/ VirusTotal report: https://www.virustotal.com/gui/domain/trezorauthentication.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=trezorauthentication.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:31:44 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0f661-9966-713f-9f8e-13b58329dda3.png Captured: 2026-10-03 19:08:19 UTC - URLScan ยท 2026-10-03: https://screenshots.phishdestroy.io/us/01a1032c-e061-7588-9b75-f1bb320ba2dd.png Captured: 2026-10-03 19:10:41 UTC Source report: https://urlscan.io/result/01a1032c-e061-7588-9b75-f1bb320ba2dd/ SHA-256: 356ebef2bc29dfdc1c07c7c1691d4014eccef83b12bb670ad8cf009894b610d3 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T19:33:52Z", "uuid": "01a0f661-9966-713f-9f8e-13b58329dda3", "scanned_at": "2026-10-01T07:33:30Z", "final_url": "http://trezorauthentication.com/", "status": 200, "redirects": [ { "to": "https://trezorauthentication.com/", "from": "http://trezorauthentication.com/", "status": 307 }, { "to": "http://trezorauthentication.com/", "from": "https://trezorauthentication.com/", "status": 307 } ], "ip": "74.208.236.56", "ptr": "74-208-236-56.elastic-ssl.ui-r.com", "domains": [ "cors.uicdn.net" ], "ips": [ "217.160.86.60", "74.208.236.56" ], "asns": [ "8560" ], "countries": [ "DE", "US" ], "link_domains": [ "www.ionos.ca", "my.ionos.ca" ], "doc_hash": "933d939fea8a1123e1f88d9b23d9e44196773b930eff6d8405362a8494db2fb9", "globals": [ "f" ], "domain_age_days": 0, "apex_age_days": 0, "requests": 14, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 20, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Apache", "content-type": "text/html" } }, "vt": { "v": 1, "fetched_at": "2026-10-21T13:18:54Z", "analysis_at": "2026-10-07T02:01:08Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 9, "suspicious": 2, "undetected": 34 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Fortinet": "phishing", "URLQuery": "suspicious", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "registrar": "IONOS SE", "created": "2026-09-30T18:42:40Z", "expires": "2027-09-30T18:42:40Z", "updated": "2026-09-30T18:42:45Z", "first_seen": "2026-10-02T17:07:52Z", "dns": [ { "ttl": 3600, "type": "A", "value": "74.208.236.56" }, { "ttl": 21600, "type": "NS", "value": "ns1080.ui-dns.com" }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 include:_spf-us.ionos.com ~all" }, { "ttl": 21600, "type": "SOA", "rname": "hostmaster.1und1.com", "value": "ns1120.ui-dns.org" }, { "ttl": 3600, "type": "MX", "value": "mx00.ionos.com", "priority": 10 }, { "ttl": 3600, "type": "MX", "value": "mx01.ionos.com", "priority": 10 }, { "ttl": 3600, "type": "AAAA", "value": "2607:f1c0:100f:f000::200" }, { "ttl": 21600, "type": "NS", "value": "ns1120.ui-dns.org" }, { "ttl": 21600, "type": "NS", "value": "ns1105.ui-dns.biz" }, { "ttl": 21600, "type": "NS", "value": "ns1100.ui-dns.de" } ], "dns_at": "2026-10-07T02:01:20Z", "whois": { "registrar": "IONOS SE", "registrar_iana_id": "83", "registrar_url": "http://www.ionos.com", "created": "2026-09-30T18:42:40Z", "updated": "2026-09-30T18:42:45Z", "expires": "2027-09-30T18:42:40Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "ns1080.ui-dns.com", "ns1100.ui-dns.de", "ns1105.ui-dns.biz", "ns1120.ui-dns.org" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-09-30T18:42:45Z", "registration": "2026-09-30T18:42:40Z", "registrar expiration": "2027-09-30T18:42:40Z", "last update of RDAP database": "2026-10-02T17:09:58Z" } } } } ```