xn--trezr-581b[.]net

xn--trezr-581b.net has been classified as a credential theft phishing domain targeting financial users. This domain impersonates a legitimate financial platform (TreZr) using a homograph attack via the Punycode-encoded name (xn--trezr-581b), which translates to a visually identical string resembling “trezer.net”. Security research confirms this domain hosts a credential harvesting kit designed to steal login credentials under the guise of a cryptocurrency wallet service. The phishing page mimics a login portal for a fake digital asset management platform, likely aiming to deceive users into surrendering wallet credentials or private keys. Whois analysis suggests a recently registered domain leveraging free SSL (Let’s Encrypt) to appear legitimate.

This domain was flagged by PhishDestroy with an elevated risk classification. Technical indicators include a VirusTotal detection ratio of 7 out of 95 security vendors, a registration date of April 16, 2026, and hosting on IP address 145.249.115.168. The domain is registered through Hosting Concepts B.V. d/b/a Registrar.eu and leverages a Let’s Encrypt SSL certificate to mimic trust. PhishDestroy analysis indicates this domain has not yet been added to Google Safe Browsing (GSB) or major DNS blocklists at the time of assessment, increasing the likelihood of exposure to end users.

As of this report, xn--trezr-581b.net remains active and poses an elevated threat to users attempting to access financial services. Immediate user action includes blocking the domain at the network level, avoiding any interaction with login portals, and reporting the domain to threat intelligence platforms and browser vendors. The domain’s recent registration and low blocklist presence suggest it is actively being used in credential theft campaigns, particularly targeting crypto-savvy users. Users should verify any financial service domain through official channels and avoid clicking links from unsolicited communications.