trezor-website-gules-arab-jhon-pod-paint-figma-gole-324324-psi[.]vercel[.]app

PhishDestroy identifies an active brand impersonation threat targeting Trezor users via the domain trezor-website-gules-arab-jhon-pod-paint-figma-gole-324324-psi.vercel.app. This fraudulent site exploits Trezor’s brand recognition to deceive victims into divulging sensitive wallet credentials or transferring cryptocurrency. The domain employs a deceptive naming strategy, embedding Trezor within a convoluted string of unrelated words and numbers to appear legitimate at a glance. No drainer kit signatures were detected in automated analysis, suggesting either a newly deployed or lightweight phishing toolkit. The page’s structure and potential payload remain under forensic evaluation to determine the full scope of the operation. This domain resolves to IP address 64.29.17.131 and is registered through Vercel Inc., leveraging the Vercel.app subdomain platform. Automated scans via VirusTotal currently report 0 detections out of 95 engines, indicating low immediate detection by antivirus solutions. The SSL certificate is issued by Google Trust Services, which may lend false legitimacy to users unfamiliar with domain verification processes. Google Safe Browsing (GSB) has not yet flagged this domain, and no third-party blocklist entries were detected at the time of analysis. The domain’s creation date and registrar details remain opaque due to Vercel’s privacy-preserving registration practices, complicating historical threat intelligence gathering. As of the latest assessment, this domain remains active and under investigation, with no immediate takedown action reported. Users are advised to avoid interacting with any site referencing Trezor outside of the official trezor.io domain. Security teams should monitor this domain for shifts in payload delivery or infrastructure changes, as the lack of detections suggests potential for rapid evolution. The current risk is classified as 'under_investigation' due to evolving intelligence gaps, but the active status and brand exploitation pose a credible threat to cryptocurrency holders. Immediate user action includes verifying site authenticity via official channels and reporting suspicious domains to PhishDestroy or relevant cybersecurity authorities.