trezorft[.]gitbook[.]io

The domain trezorft.gitbook.io is an active phishing endpoint impersonating Trezor, a cryptocurrency hardware wallet provider. Infrastructure analysis reveals the domain remains operational as of July 12, 2026, with no indication of takedown or remediation. The site is hosted on Cloudflare infrastructure, resolving to IP address 104.18.40.47, and employs HTTP/3 for content delivery. The domain was originally registered on March 30, 2014, though this long-standing registration does not correlate with legitimate use in this context, as the current activity aligns with recent phishing campaigns targeting cryptocurrency users. Technical indicators confirm malicious intent. The domain appears on three security blocklists and is actively blocked by cryptocurrency-focused security tools, including MetaMask and PhishDestroy. A Gridinsoft trust score of 0/100 further supports classification as high-risk, while VirusTotal reports 14 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, a common characteristic of both legitimate and malicious sites, providing no inherent trust signal in isolation. The primary uncertainty lies in the specific phishing kit or payload deployed, as no direct forensic evidence of the attack chain is provided in available intelligence. However, the combination of brand impersonation, active blocklisting, and cryptocurrency-specific defenses being triggered strongly suggests this is a credential harvesting or wallet-draining operation. Defenders should treat this domain as hostile and prioritize blocking at the network and endpoint levels. Cryptocurrency service providers are advised to monitor for user interactions with this domain and implement additional authentication or warning mechanisms for affected accounts.