start-en-us-docs[.]teachable[.]com

This domain, start-en-us-docs.teachable.com, is flagged as a generic phishing site targeting users of the Trézór hardware wallet brand, based on the page title 'Trézór Bridge® | Introducing the New Trézór App' extracted before takedown. Analysis indicates the domain was registered on February 21, 2026, through Amazon Registrar, Inc., and resolved to a Cloudflare IP (104.17.82.54, AS13335) in the US. The site was served via Cloudflare nameservers (ian.ns.cloudflare.com, nina.ns.cloudflare.com) with an SSL certificate issued by Google Trust Services (WR3). Technologies detected include Google Cloud, Mailgun, HSTS, Google Cloud CDN, and HTTP/3, suggesting a professionally configured infrastructure often used to evade detection.

As of July 24, 2026, the domain is offline, returning an HTTP 404 status. It appears on one security blocklist (PhishDestroy) and was flagged by 2 of 93 security vendors on VirusTotal prior to takedown. The combination of a cryptocurrency-related brand impersonation, Cloudflare hosting, and low but non-zero detection rates aligns with patterns observed in credential-harvesting or malware-distribution campaigns. Defenders should treat any prior connections to this domain as high-risk, particularly if associated with Trézór wallet users or cryptocurrency transactions.

No evidence links this domain to a specific phishing kit or additional payloads, and the exact content served remains unanalyzed. However, the infrastructure and targeting suggest a focus on stealing wallet credentials or distributing malicious software. Organizations should block the domain at the DNS level, monitor for related subdomains under teachable.com, and review logs for prior connections from internal assets. The use of Teachable’s legitimate subdomain structure may have been exploited to bypass initial reputation checks, underscoring the need for layered detection controls.