trezlognt[.]gitbook[.]io

Analysis of the domain trezlognt.gitbook.io indicates active brand-impersonation phishing targeting Trezor, a cryptocurrency hardware wallet provider. The domain, registered through Cloudflare, Inc. on March 30, 2014, currently resolves to the IP address 104.18.40.47. Infrastructure analysis reveals the use of GitBook, Google Cloud, and Cloudflare technologies, including HTTP/3 and HSTS, suggesting a hosted service rather than a self-managed phishing kit. The SSL certificate is issued by Google Trust Services, which does not inherently indicate malicious intent but aligns with the observed cloud-based hosting. The page title, 'Trezor @Login | Trezor®....Gitbook | us,' explicitly references Trezor’s branding, reinforcing the domain’s intent to deceive users into believing they are accessing a legitimate Trezor login portal. Detection data shows the domain appears on three security blocklists, including SEAL, MetaMask, and PhishDestroy, which have flagged it as malicious. Additionally, four of ninety-five security vendors on VirusTotal have classified the domain as phishing-related, though the absence of broader detection does not preclude its threat status. The domain’s creation date predates the observed phishing activity by over a decade, suggesting either a compromised or repurposed legitimate resource rather than a newly registered malicious domain. This longevity may contribute to its evasion of some detection mechanisms. Defenders should prioritize blocking or monitoring access to this domain, particularly in environments where Trezor-related services are used. Further investigation into the hosting infrastructure and any associated accounts or subdomains is recommended to assess the full scope of this campaign.