name-trezor-help-dvoy[.]vercel[.]app

This domain, name-trezor-help-dvoy.vercel.app, is flagged for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the infrastructure is designed to mimic legitimate Trezor support or recovery pages, likely aiming to harvest sensitive credentials or private keys from unsuspecting users. The domain shows no direct evidence of a crypto drainer kit at this stage, but the deployment status suggests preparatory staging or a dormant payload awaiting activation. The threat type aligns with known patterns of brand impersonation used to facilitate unauthorized access to digital asset wallets. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on February 21, 2026, through Tucows Domains Inc., a registrar frequently observed in phishing campaigns due to its accessibility and bulk registration capabilities. It resolves to IP address 216.198.79.3, hosted on Amazon.com, Inc. (AS16509), a common cloud provider for malicious deployments. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the domain's fraudulent intent. VirusTotal detection shows 18 out of 95 security vendors flagging the domain, a moderate but concerning score that underscores its malicious classification. The domain appears on four security blocklists, including PhishDestroy, MetaMask, SEAL, and PhishingDB, further validating its high-risk status. Current status indicates the domain remains active, though the page title 'Deployment Unavailable' suggests either a temporary staging state or a deliberate evasion tactic to avoid detection during analysis. Response actions by security vendors have already blocked access through multiple channels, reducing immediate exposure risk. However, the domain's persistence and the registrar's historical association with malicious activity warrant continued monitoring. Users are advised to treat any communication or page associated with this domain as fraudulent. Verification of Trezor-related services should exclusively occur through official channels, and wallet recovery processes should never be initiated via third-party links or unsolicited messages.