trazar-io[.]created[.]app

On July 25 2026 the domain trazar-io.created.app was observed offline after being taken down by PhishDestroy. The site resolved to the Amazon‑owned IP address 216.150.16.1 (AS16509, United States) and was hosted on Vercel infrastructure, as indicated by the DNS records ns1.vercel-dns.com and ns2.vercel-dns.com and the presence of Vercel technology signatures. The TLS certificate was issued by Let’s Encrypt (R13) and enforced HSTS, but the HTTP response returned a 404 status code, and the page title captured by crawlers reads “Trezor.io/Start® — Starting Up Your Device | TreZor®”, indicating an attempt to impersonate the Trezor hardware‑wallet brand.

The domain was registered on July 12 2023 through Tucows Domains Inc., and the registrar information matches the creation date. VirusTotal scans reported 10 detections out of 95 security vendors, confirming malicious classification. The domain appears on a single security blocklist and was flagged by PhishDestroy as a crypto‑scam impersonating Trezor.

Current evidence confirms the infrastructure, branding, and malicious intent, but the exact payload or credential‑harvesting mechanism remains unknown because the site returned a 404 page and no further content was captured. Defenders should block the domain and its associated IP at network perimeter, update IDS/IPS signatures with the observed TLS fingerprint and Vercel DNS pattern, and monitor for any new subdomains or similar Vercel‑hosted domains targeting Trezor users. Continuous threat‑intel feeds should be consulted for additional indicators, and affected users should be warned to verify URLs before entering wallet credentials.