official-setup-portal-trezor[.]onrender[.]com

This domain, official-setup-portal-trezor.onrender.com, is actively engaged in brand impersonation targeting Trezor, a well-known cryptocurrency hardware wallet provider. Analysis indicates the site mimics Trezor’s official storefront, presenting itself as a legitimate portal for hardware wallet setup and purchases. The threat type is classified as brand impersonation, designed to deceive users into divulging sensitive information or transferring cryptocurrency under false pretenses. No direct evidence of a crypto drainer kit has been identified, but the infrastructure aligns with known impersonation tactics used in credential theft and fraudulent transactions. Infrastructure analysis reveals the domain is flagged by 13 out of 95 security vendors on VirusTotal, indicating a high likelihood of malicious activity. The domain resolves to the IP address 216.24.57.251, hosted on AS397273 Render, a US-based provider. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, a common practice for both legitimate and malicious sites. The domain appears on one security blocklist, and its page title, 'Trezor Hardware Wallet | Official Store,' further reinforces the impersonation attempt. No creation date or registrar details were provided, but the use of a cloud-based hosting service suggests a low-cost, disposable infrastructure typical of phishing campaigns. The domain remains active as of the latest assessment, posing an ongoing risk to users who may mistake it for the legitimate Trezor platform. Response actions should include immediate blacklisting by security providers, takedown requests to the hosting provider, and public warnings to alert potential victims. Despite these measures, the remaining risk remains high due to the domain’s persistence and the targeted nature of the impersonation. Users are advised to verify domain authenticity through official channels, enable multi-factor authentication, and avoid entering sensitive information on unverified platforms. Organizations should monitor for similar domains leveraging cloud hosting services to evade detection.