offcal-trzzrstrt-net[.]weebly[.]com

Analysis of the domain offcal-trzzrstrt-net.weebly.com indicates it was actively impersonating Trezor, a cryptocurrency hardware wallet provider, as of its takedown. The page title explicitly claimed affiliation with Trezor, displaying 'Official Site® | Trezor.io/start® | Getting Started - Official Site® | Trezor.io/start® | Getting Started,' a tactic designed to deceive users into believing the site was legitimate. The domain was hosted on Weebly's infrastructure (AS27647, Weebly, Inc.) and resolved to IP 74.115.51.8, located in the United States. Cloudflare was detected as a technology in use, likely for content delivery or security obfuscation. The domain was registered through Safenames Ltd. on March 29, 2006, though this creation date may reflect the registration of the parent Weebly subdomain rather than the specific malicious campaign.

At the time of reporting, the domain returned an HTTP 404 status, confirming its offline status. A Let's Encrypt SSL certificate (serial E8) was present, providing HTTPS encryption, which is commonly exploited by threat actors to lend false legitimacy. Nameservers were hosted on AWS (ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns), a frequent choice for both legitimate and malicious infrastructure. The domain appeared on one security blocklist (PhishDestroy), and 14 of 93 security vendors on VirusTotal flagged it as malicious, though the exact detection context (e.g., phishing, malware, or brand abuse) is not specified. Defenders should treat this domain as part of a crypto scam targeting Trezor users, likely aiming to harvest wallet credentials or distribute malicious software.

The use of a Weebly subdomain suggests low-cost, disposable infrastructure, a common characteristic of phishing campaigns. While the domain is currently offline, monitoring for re-emergence under similar subdomains or related IPs (74.115.51.8) is recommended.