started-treozr-io[.]created[.]app

On July 24, 2026, the domain started-treozr-io.created.app was identified as a brand impersonation threat targeting Trezor, a well-known brand in the cryptocurrency hardware wallet industry. The domain was registered through Tucows Domains Inc. on July 12, 2023, and currently resolves to the IP address 216.150.1.1, which is located in the United States and is associated with Amazon.com, Inc. (AS16509). The domain is known to have an SSL certificate issued by Let's Encrypt, specifically R13, which can lend a false sense of security to unsuspecting users.

The page title found during analysis is 'Trezor.io/start: Secure Your First Bitcoin Today', indicating a potential crypto scam. The domain is currently offline, returning an HTTP 404 status code, and has been flagged by 12 out of 95 security vendors on VirusTotal, suggesting a moderate level of suspicion. The domain is also listed on one security blocklist, and it has been blocked by PhishDestroy, a security service.

Infrastructure analysis reveals that the domain uses Vercel for hosting and has HSTS (HTTP Strict Transport Security) enabled, which can further obscure the true nature of the site. While the domain is currently offline, defenders should remain vigilant and monitor for any signs of reactivation. Given the elevated risk level and the specific targeting of a known brand, it is recommended that organizations and users take proactive measures to educate their staff and customers about the dangers of crypto scams and to verify the authenticity of Trezor-related domains through official channels.