en-trezorstart[.]blogspot[.]md

The domain en-trezorstart.blogspot.md is actively impersonating Trezor, a well-known cryptocurrency hardware wallet brand. It has been flagged as malicious by 9 out of 95 vendors on VirusTotal, indicating significant recognition of its threat potential. The domain is hosted on Google's infrastructure with an IP located in Germany, under ASN AS15169. This strategic choice of hosting may lend it an appearance of legitimacy, potentially deceiving users who trust Google's services.

The phishing site uses a page title mimicking Trezor's official setup page, 'Trezor.io/Start® - Starting Up Your Device | TreZor®', to lure unsuspecting users. This tactic is designed to trick users into believing they are on a legitimate Trezor site, likely aiming to steal sensitive information such as recovery seeds or passwords. The domain's platform risk score is notably high at 85/100, underscoring the significant threat it poses to users.

PhishDestroy and other entities like MetaMask and SEAL have added this domain to their blocklists, reflecting its recognized risk. The absence of a registrar in the records might indicate an attempt to obscure its origins, complicating efforts to trace and shut down the operation. The use of Google's SSL issuer, Google Trust Services, further adds a layer of perceived authenticity, making it a sophisticated threat. This case highlights the need for rapid detection and response to phishing domains, as they can exploit the critical window before antivirus databases are updated.