authstart-terezor[.]github[.]io

This domain, authstart-terezor.github.io, is actively engaged in brand impersonation specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. The threat type is classified as brand impersonation with potential credential theft or crypto drainer capabilities, presenting a high-risk scenario for users seeking legitimate Trezor services. The domain remains operational as of the latest verification, continuing to pose a significant threat to unsuspecting visitors. Analysis indicates that the domain is registered through GitHub, Inc. and resolves to the IP address 185.199.111.153, hosted on AS54113 (Fastly, Inc.) in the United States. The SSL certificate is issued by Let’s Encrypt (R12), a common practice among both legitimate and malicious sites. The page title, "Trezor.io/Start® | Trezor Suite App (Official) | Trezor®," is designed to deceive users into believing they are accessing an official Trezor resource. Security vendors have flagged this domain, with 14 out of 95 VirusTotal engines identifying it as malicious. Additionally, Google Safe Browsing has explicitly marked it as a phishing site, and it appears on at least one security blocklist, further corroborating its fraudulent nature. Current infrastructure analysis reveals that the domain is still active, and users are strongly advised to avoid interaction. Organizations should immediately block access to this domain and its associated IP address (185.199.111.153) at the network perimeter. Users who may have visited this site should verify their device for malware, reset any credentials entered, and monitor their cryptocurrency wallets for unauthorized transactions. Trezor users are urged to access official resources only through verified channels, such as the legitimate Trezor.io domain, and to enable multi-factor authentication where available to mitigate risks associated with credential theft.