xn--trzor-7za[.]net

xn--trzor-7za.net is a homograph domain impersonating the official Trezor hardware wallet to harvest user credentials and cryptocurrency. The attackers exploit Unicode characters in the domain name to create a visually convincing replica of the real Trezor site (trezor.io), tricking users into entering their recovery phrases or login details on a fraudulent interface. This technique bypasses basic browser warnings and can lead to irreversible financial loss if users fall victim. This domain poses an elevated risk and was flagged by MetaMask and SEAL, two trusted security systems. Research indicates it was registered through Hosting Concepts B.V. d/b/a Registrar.eu on March 30, 2026, and currently resolves to IP address 145.249.115.168. Threat intelligence shows that 8 out of 95 security vendors on VirusTotal identify this domain as malicious, and it appears on 2 active blocklists, further validating its harmful nature. Its SSL certificate, issued by Let’s Encrypt, adds a false sense of legitimacy, enhancing the success rate of the phishing campaign. If you have visited xn--trzor-7za.net or entered any wallet credentials, immediately disconnect from the internet, revoke access to your wallet on the real Trezor platform if possible, and transfer your assets to a new wallet using a clean, isolated device. Enable two-factor authentication on all crypto-related accounts and consider using a hardware wallet for enhanced security. Scan your system with reputable antivirus software to detect any malware that may have been installed during the visit. Report the domain to your wallet provider and local cybercrime authorities to help prevent others from falling victim to this scam.