io-trezer-starts-learn[.]weebly[.]com

The domain io-trezer-starts-learn.weebly.com was registered on March 29, 2006 and is currently hosted on the Weebly infrastructure (AS27647, United States). DNS resolution points to IP address 74.115.51.8, which is owned by Amazon Web Services and is fronted by Cloudflare services. The site presents a TLS certificate issued by Let’s Encrypt (certificate identifier E8), confirming that HTTPS is available despite the content returning an HTTP 404 status code. The page title observed in the last crawl, "Trezor Start — Secure Your Crypto Journey," directly references the Trezor brand, indicating a deliberate attempt to impersonate the hardware‑wallet provider.

The registrar for the domain is Safenames Ltd, and the authoritative nameservers are a mixed set of AWS DNS entries (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns). The domain has been flagged by PhishDestroy and appears on a single security blocklist, confirming that threat‑intelligence feeds have identified it as malicious. VirusTotal scans show that 15 out of 95 security vendors label the domain as suspicious, reinforcing the suspicion of abuse. The risk rating assigned is elevated, and the operational status is listed as offline, suggesting the site has been taken down or is no longer serving content.

While the exact phishing kit or payload is not disclosed, the combination of brand‑specific page title, TLS presence, cloud hosting, and multiple vendor detections provides strong evidence of a brand‑impersonation campaign targeting Trezor users. Defenders should continue to block the domain at perimeter filters, monitor the associated IP range for related activity, and advise users to verify URLs against official Trezor channels. Ongoing surveillance of the registrar and nameserver set is recommended to detect any re‑hosting attempts, and any future resolutions to the same IP should be treated with heightened scrutiny given the established threat profile.