about-iotrezur[.]gitbook[.]io

The domain about-iotrezur.gitbook.io was identified as a brand impersonation threat specifically targeting Trezor, the well-known hardware cryptocurrency wallet. This malicious domain was designed to deceive users into believing they were accessing the official Trezor login page, thereby harvesting sensitive credentials and potentially draining cryptocurrency wallets. The phishing kit used in this campaign mimics the legitimate Trezor authentication flow, making it particularly dangerous for unsuspecting users.

Technical analysis reveals that the domain was registered through Cloudflare, Inc and resolves to IP address 104.18.40.47, with an SSL certificate issued by Google Trust Services (WE1). According to VirusTotal, 9 out of 95 security vendors flagged this domain as malicious, and it appears on 3 security blocklists. The domain was created on June 15, 2026, and its page title was observed as "Trezor @Login: The Official Wallet - GitBook | us". Notably, Google Safe Browsing has not yet listed this domain, indicating a gap in automated detection that underscores the importance of user vigilance.

As of the latest check, the domain has been taken offline, which is a positive development. However, the risk remains that similar domains may appear or that the same threat actors may register new domains. Users who may have interacted with this site should immediately change their Trezor-related passwords and enable two-factor authentication. It is also recommended to monitor cryptocurrency wallets for unauthorized transactions and to report any suspicious activity to Trezor support. PhishDestroy continues to monitor for related threats and advises users to always verify URLs directly through official channels before entering credentials.