trezer-iostartpages[.]weebly[.]com

Analysis of trezer-iostartpages.weebly.com shows a clear cryptocurrency‑related impersonation of the Trezor hardware‑wallet brand. The site’s sole visible artifact is the page title “Trezor Wallet Setup — Trezor.io/start - Trezor Wallet Setup — Trezor.io/start,” which directly mirrors official Trezor terminology and indicates an intent to lure victims into a fraudulent wallet‑setup flow. The domain was registered through Safenames Ltd and has a creation date of March 29 2006, suggesting that the subdomain was later allocated by the free‑hosting service Weebly rather than being a freshly registered phishing domain. DNS resolution points to IP address 74.115.51.8, a block owned by AS27647 Weebly, Inc. in the United States, and the hosting infrastructure is fronted by Cloudflare, a common choice for both legitimate and malicious actors seeking DDoS mitigation.

TLS termination uses a Let’s Encrypt certificate (E8), providing a valid HTTPS connection, while the HTTP response currently returns a 404 status, consistent with the site being taken offline after detection. Threat intelligence feeds have flagged the domain on one public blocklist, and PhishDestroy has recorded it as blocked. VirusTotal analysis shows that 14 of 95 security vendors have flagged the domain, reinforcing the suspicion of malicious activity.

The risk rating is elevated, and the current status is offline, indicating that mitigation actions have been applied. Defenders should maintain the block on the associated IP range, continue monitoring the parent Weebly hosting environment for similar subdomains, and ensure that endpoint protection solutions incorporate the VirusTotal detection data. Because the site is no longer reachable, immediate user exposure is low, but the presence of a valid SSL certificate and Cloudflare front‑end demonstrates that future re‑hosting on the same infrastructure is feasible; continuous vigilance is advised.