welcome-trazo-cdn[.]netlify[.]app

This domain poses a high risk due to its specific impersonation of Trezor, a leading hardware wallet brand, in a brand impersonation attack. The phishing site mimics Trezor's official setup guide to trick users into entering sensitive recovery phrases and private keys, which could lead to complete loss of cryptocurrency funds. The threat is active and hosted on Netlify, a legitimate platform abused for malicious purposes.

Technical indicators reveal that the domain is flagged by 3 out of 95 security vendors on VirusTotal, indicating partial but significant detection. It is registered through Netlify and resolves to IP address 35.157.26.135. The SSL certificate is issued by DigiCert Inc using a DigiCert Global G2 TLS RSA SHA256 2020 CA1, lending a false sense of legitimacy. The domain appears on 3 security blocklists, confirming its malicious reputation. The page title, "Trezor.io/Start Guide – How to Set Up Your Trezor Wallet Securely," is crafted to deceive users searching for official Trezor guidance.

To mitigate this threat, users should always verify URLs before entering sensitive information, especially for cryptocurrency services. Avoid clicking on links in unsolicited emails or messages; instead, manually type the official Trezor URL (trezor.io) into the browser. Use hardware wallets only with official software and never share recovery seeds online. Report the domain to Netlify and security vendors to aid in takedown efforts. Enable phishing protection in browser extensions and keep security software updated to block such malicious sites.