zec[.]blockbook[.]swapkit[.]dev

Analysis of zec.blockbook.swapkit.dev indicates that the site was deliberately crafted to impersonate the Trezor brand, presenting a page titled "Trezor Zcash Explorer". The domain is registered through Cloudflare, Inc., and the hosting infrastructure is also provided by Cloudflare (ASN13335) with the resolved address 172.66.40.88 located in the United States. The site employed HTTP Strict Transport Security (HSTS) and presented an SSL certificate issued by Google Trust Services under the WE1 profile, suggesting a legitimate TLS configuration despite the malicious intent. Security telemetry shows that 11 of 95 VirusTotal scanners flagged the domain, reflecting a moderate detection consensus among reputable vendors.

The domain has been added to a single security blocklist and is actively blocked by PhishDestroy, confirming that at least one external mitigation service has taken action. Current operational status is offline, which may indicate takedown or temporary suspension, but the underlying infrastructure remains observable. Defenders should continue to deny any network connections to 172.66.40.88, add the fully qualified domain name to intrusion detection signatures, and monitor for newly registered subdomains that reuse the "swapkit.dev" suffix or similar Trezor‑related keywords.

Because the registrar is Cloudflare, future domains may appear under the same registrar with comparable hosting patterns; therefore, threat‑intel feeds should be queried for new registrations matching the "blockbook.swapkit.dev" pattern. Continuous review of SSL certificate provenance and HSTS headers can aid in distinguishing legitimate Cloudflare‑hosted services from impersonation attempts. Recommendations include updating web filtering rules, informing end‑users about the Trezor brand impersonation, and tracking any resurgence of the domain on additional blocklists or detection platforms.