eng-trezzor-io-strt[.]weebly[.]com

PhishDestroy identifies eng-trezzor-io-strt.weebly.com as a live fake Trezor wallet phishing portal engineered to harvest cryptocurrency credentials. The domain weaponizes a misspelled, recycled Weebly subdomain to appear legitimate while hosting a spoofed login page that requests seed phrases and private keys. Attackers are actively rotating infrastructure—this host resolves to IP 74.115.51.9 with a recent Let’s Encrypt certificate to evade browser warnings. The domain has flown under the radar with 16/95 VirusTotal detections and remains unlisted on major threat-intel feeds, underscoring its deceptive freshness.

Technical indicators reinforce its malicious intent: registered through MarkMonitor on March 29, 2006—long before Weebly’s 2006 inception—indicating a legacy typo-squat. Despite its age, the subdomain was likely repurposed only recently for phishing campaigns. The absence of detections suggests either a slow-burn campaign or a zero-day clone relying on semantic deception rather than known malware payloads. Security researchers should flag the combination of a recycled registrar account, deceptive subdomain structure, and zero AV coverage as a red flag for credential harvesting.

If you visited eng-trezzor-io-strt.weebly.com, immediately revoke any seed phrases or private keys entered on the page. Disconnect from the network, clear browser cache and cookies, and run a malware scan. Report the domain to your antivirus vendor and Trezor’s abuse team (support@trezor.io). Avoid similar misspelled wallet domains and always navigate to official URLs via bookmarks or verified search results.