7dckzuox[.]dora[.]run

The domain 7dckzuox.dora.run was identified as a brand impersonation phishing site targeting Trezor, a popular hardware cryptocurrency wallet. The page title, 'Trezor Suite App (Official) | Desktop & Web Crypto ...', was designed to deceive users into believing they were accessing the legitimate Trezor Suite platform. This type of attack typically aims to steal login credentials or seed phrases, often employing a crypto drainer kit to empty victims' wallets. PhishDestroy categorizes this threat as elevated risk due to the sensitive nature of the targeted brand and the potential for financial loss.

Technical analysis reveals that the domain was flagged by 3 out of 95 security vendors on VirusTotal, indicating moderate detection at the time of analysis. It was registered through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and resolved to IP address 35.71.144.143. The SSL certificate was issued by Amazon for Amazon RSA 2048 M03, which is commonly used for legitimate services, adding a layer of false credibility. The domain appeared on one security blocklist and was not listed on Google Safe Browsing at the time of investigation, meaning it may have evaded some automated filters.

As of the latest intelligence, the domain has been taken offline, which is a positive outcome for users. However, given the dynamic nature of phishing operations, similar domains may reappear under different names. PhishDestroy recommends that users always verify the authenticity of any Trezor-related site by double-checking the URL and using official bookmarks. Never enter your recovery seed phrase on any website, and enable two-factor authentication where possible. If you have already interacted with this domain, immediately transfer your funds to a new wallet and contact Trezor support for further guidance.