trezor-website-woad-five-sigma-dfasf-324324-343244[.]vercel[.]app

The domain trezor-website-woad-five-sigma-dfasf-324324-343244.vercel.app was registered on February 21, 2026 through Tucows Domains Inc. and resolves to the IP address 216.198.79.3, which belongs to Amazon.com, Inc. (AS16509) in the United States. An HTTPS connection is offered using a Google Trust Services certificate (WR1) and the site advertises HTTP Strict Transport Security (HSTS). The web server returns an HTTP 404 status with the page title "404: NOT_FOUND," indicating that no landing page is currently served. Vercel is identified as the hosting technology, matching the .vercel.app suffix. VirusTotal analysis shows that nine of ninety‑five scanning engines have flagged the domain, suggesting malicious characteristics despite the lack of a publicly reachable payload.

The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a crypto‑related scam. The threat is classified as a brand impersonation targeting the cryptocurrency hardware‑wallet provider Trezor. The intelligence indicates the site is being used to mimic Trezor’s brand, although the exact content of any fraudulent page cannot be confirmed because the site is offline and returns only a 404 response. Current uncertainties include the nature of the malicious payload (if any), the presence of credential‑stealing forms, or additional infrastructure components such as command‑and‑control servers.

No evidence of URL shorteners, third‑party trackers, or external resources has been observed. Defenders should add the full hostname to blocklists, monitor DNS queries for the sub‑domain pattern "trezor‑website‑woad‑five‑sigma*" and the associated IP range, and enforce TLS inspection to capture any future content if the site becomes active. Continuous re‑query of VirusTotal and other sandbox services is recommended to capture any evolving behavior.