trezorr-en[.]netlify[.]app

Analysis of the domain trezorr-en.netlify.app confirms its classification as a phishing site targeting Trezor, a cryptocurrency hardware wallet brand. The domain was hosted on Netlify infrastructure and resolved to an IPv6 address 2a05:d014:58f:6200::258, geolocated to Germany under Amazon.com, Inc.'s AS16509. The SSL certificate was issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), a common certificate authority for both legitimate and malicious sites, offering no inherent trust signal. The page title, 'Trezor Suite Features You Need to Know Before You Start,' directly aligns with Trezor's branding, indicating intent to deceive users into believing the site is an official Trezor resource. The domain appears on one security blocklist, and 13 of 95 security vendors on VirusTotal flagged it as malicious, reinforcing its elevated risk status.

The scam type is explicitly categorized as a crypto scam, consistent with Trezor's product focus. Technologies detected include Netlify hosting and HTTP Strict Transport Security (HSTS), the latter often used to lend a false sense of security to phishing pages. Nameservers were dns1.p04.nsone.net and dns2.p04.nsone.net, and the site returned an HTTP 404 status at the time of analysis, suggesting it was taken offline or moved. Defenders should treat this domain as confirmed malicious infrastructure.

Blocklists should include the domain and its resolved IP address. Organizations using Trezor products should alert users to avoid any interaction with this domain, even if it appears inactive. Further investigation into associated Netlify accounts or linked domains may uncover additional phishing infrastructure. The exact content of the phishing page remains unanalyzed, but the available evidence—brand impersonation, page title, and detection data—supports its classification as a crypto-focused phishing site.