ai-trezor[.]gitbook[.]io

This domain, ai-trezor.gitbook.io, is flagged as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The page mimics the official Trezor setup portal, displaying the title 'Trezor.io/start | Set Up Your Trezor' to deceive users into entering sensitive credentials or recovery phrases. Analysis indicates no direct evidence of a crypto drainer kit, but the domain’s infrastructure and content are designed to facilitate credential harvesting or unauthorized access to cryptocurrency wallets. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was created on June 15, 2026, and resolves to the IP address 172.64.147.209. It is registered through Cloudflare, Inc., and holds an SSL certificate issued by Google Trust Services. VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. Google Safe Browsing (GSB) status is not explicitly provided but is likely flagged given the blocklist presence. The domain remains active and poses a significant risk to users attempting to set up or recover Trezor devices. Immediate response actions include blocking the domain at the network level, revoking SSL certificates if possible, and notifying the hosting provider (GitBook) for takedown. Users are advised to verify the authenticity of any setup portal by cross-referencing the official Trezor website and avoiding interaction with this domain. The remaining risk is high due to the domain’s persistence, professional impersonation tactics, and lack of enforcement actions observed thus far.