trezor-website-ram-pod-paint-sigma-gole-324324-psi[.]vercel[.]app
“Connect & Find Your Trezor”
trezor-website-ram-pod-paint-sigma-gole-324324-psi.vercel.app — Conteúdo indisponível. Representação da marca: Trezor; Tipo de golpe: Crypto Scam. Resumo das evidências: VirusTotal 9/95 (ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, Fortinet); URLScan malicious verdict; PhishDestroy score 77/100. Registrador: Vercel.
A análise detalhada do PhishDestroy AI permanece em inglês para preservar o registro forense original.
The domain trezor-website-ram-pod-paint-sigma-gole-324324-psi.vercel.app was registered through Vercel Inc. and resolves to the Amazon‑owned IP address 216.198.79.3, associated with ASN 16509. The site served a page titled “Connect & Find Your Trezor” and presented a TLS certificate issued by Google Trust Services under the WR1 root, indicating a valid HTTPS connection. Infrastructure analysis shows the use of Vercel hosting and the presence of HTTP Strict Transport Security (HSTS). The domain returned HTTP status 451, indicating that the content was unavailable for legal reasons, and it is currently listed as taken offline.
The site impersonates the Trezor hardware‑wallet brand and is classified as a crypto‑scam. It was blocked by the PhishDestroy blocklist and appears on a single security blocklist. VirusTotal scans recorded nine detections out of ninety‑five engines, reinforcing the malicious classification. Nameserver information is unavailable (NS_NOT_FOUND).
The evidence confirms that the domain was created to lure Trezor users into a credential‑harvesting flow, leveraging a legitimate‑looking page title and a trusted SSL certificate to increase credibility. Uncertainty remains regarding the specific payload delivered to victims, as the page content has not been captured and no visual artefacts have been disclosed. Defenders should continue to monitor the IP range owned by Amazon for similar Vercel‑hosted impersonation attempts, enforce blocklist updates to include this domain, and advise users to verify URLs against official Trezor resources. Threat intelligence feeds should flag the domain as a brand‑impersonation crypto scam, and any residual DNS entries should be purged to prevent resurrection attempts.
Pipeline de resposta a ameaças
Status da lista de bloqueios pública
Tecnologias · 2 identified
Cloud platform for frontend deployment, optimized for Next.js.
HTTP Strict Transport Security — forces browsers to use HTTPS connections only.
Análise do VirusTotal
Evidências arquivadas
Evidências e relatórios externos
Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo