# PhishDestroy threat dossier — xn--trzor-7za.net ================================================================ Fetched: 2026-04-18 19:28:05 UTC Canonical: https://phishdestroy.io/domain/xn--trzor-7za.net/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 8/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, Forcepoint ThreatSeeker, G-Data, Gridinsoft, Webroot Public blocklists: listed on 2 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 145.249.115.168 Registrar: Hosting Concepts B.V. d/b/a Registrar.eu Nameservers: ns1.openprovider.nl, ns2.openprovider.be, ns3.openprovider.eu Registered: 2026-03-30 Page title: href.li HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-06-28 Status: INVALID chain Fingerprint: 16f5a7ef2411aeb5d3889ff8e5c6f73f0dbe1b57e0bab5eaf55a3a3eecbd39e0 Subject Alternative Names (related infrastructure — often same operator): - www.xn--trzor-7za.net ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-30 (per WHOIS — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-18 18:38:29 UTC (by PhishDestroy tracker) Last verified: 2026-04-18 21:08:45 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019da13b-b885-7607-a670-61883e201d84/ Wayback Machine: https://web.archive.org/web/*/xn--trzor-7za.net crt.sh CT logs: https://crt.sh/?q=%25.xn--trzor-7za.net Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=xn--trzor-7za.net AlienVault OTX: https://otx.alienvault.com/indicator/domain/xn--trzor-7za.net URLhaus: https://urlhaus.abuse.ch/host/xn--trzor-7za.net/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-18 18:39:02 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] xn--trzor-7za.net is a homograph domain impersonating the official Trezor hardware wallet to harvest user credentials and cryptocurrency. The attackers exploit Unicode characters in the domain name to create a visually convincing replica of the real Trezor site (trezor.io), tricking users into entering their recovery phrases or login details on a fraudulent interface. This technique bypasses basic browser warnings and can lead to irreversible financial loss if users fall victim. This domain poses an elevated risk and was flagged by MetaMask and SEAL, two trusted security systems. Research indicates it was registered through Hosting Concepts B.V. d/b/a Registrar.eu on March 30, 2026, and currently resolves to IP address 145.249.115.168. Threat intelligence shows that 8 out of 95 security vendors on VirusTotal identify this domain as malicious, and it appears on 2 active blocklists, further validating its harmful nature. Its SSL certificate, issued by Let’s Encrypt, adds a false sense of legitimacy, enhancing the success rate of the phishing campaign. If you have visited xn--trzor-7za.net or entered any wallet credentials, immediately disconnect from the internet, revoke access to your wallet on the real Trezor platform if possible, and transfer your assets to a new wallet using a clean, isolated device. Enable two-factor authentication on all crypto-related accounts and consider using a hardware wallet for enhanced security. Scan your system with reputable antivirus software to detect any malware that may have been installed during the visit. Report the domain to your wallet provider and local cybercrime authorities to help prevent others from falling victim to this scam. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 16f5a7ef2411aeb5d3889ff8e5c6f73f0dbe1b57e0bab5eaf55a3a3eecbd39e0 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/xn--trzor-7za.net/ JSON API: https://api.destroy.tools/v1/check?domain=xn--trzor-7za.net Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io