trezoi[.]weebly[.]com

This domain, trezoi.weebly.com, is identified as a brand impersonation threat targeting Trezor, a hardware cryptocurrency wallet provider. The site was designed to deceive users into believing it was the official Trezor setup portal, as indicated by its page title: "📦️ Trezor® Start | Setup Your Trezor Model One or T in Minutes." The domain is currently offline, but prior activity warrants detailed analysis for historical and preventive purposes. Analysis indicates the domain was flagged by 17 of 95 security vendors on VirusTotal, reflecting elevated detection rates. It was registered through MarkMonitor Inc. on April 28, 2026, and resolved to the IP address 74.115.51.9, hosted by Weebly, Inc. in the United States. The domain appeared on one security blocklist and was blocked by PhishDestroy. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (serial number E8), which, while providing encryption, does not validate the legitimacy of the site. The creation date and hosting provider suggest an attempt to exploit Weebly’s free hosting services for malicious purposes. The domain has since been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar threats. Recommended actions include monitoring for domains with similar naming conventions (e.g., misspellings or subdomains impersonating Trezor), blocking the IP address 74.115.51.9 in network security controls, and educating users on verifying SSL certificates and domain authenticity before entering sensitive information. Security teams should also review logs for connections to this IP or domain to identify potential prior exposure.