authory-trezor[.]com

This domain, authory-trezor.com, is identified as a high-risk brand impersonation site targeting Trezor, a hardware cryptocurrency wallet provider. Analysis indicates the site was designed to deceive users into entering sensitive wallet credentials or downloading malicious software under the guise of legitimate Trezor services. The threat type aligns with credential theft and potential crypto asset compromise, leveraging brand trust to execute attacks. Infrastructure analysis reveals the domain was registered on March 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.96.3, geolocated to Cloudflare infrastructure in Canada. The domain is flagged by 12 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. The SSL certificate, issued by Let's Encrypt (serial number E7), provides minimal encryption but does not validate legitimacy. No Google Safe Browsing (GSB) detection was recorded at the time of analysis, though this may reflect detection latency rather than absence of threat. The domain is currently offline, likely due to takedown actions or infrastructure suspension. It has been blocked by multiple security entities, including PhishDestroy, MetaMask, and SEAL. Despite its inactive status, residual risk remains for users who may have interacted with the site prior to takedown. Organizations and individuals are advised to monitor for unauthorized access attempts linked to this domain, revoke any credentials potentially exposed, and verify wallet integrity. Proactive blocklisting of the domain and associated IP is recommended to prevent future access attempts.