10487-trezor[.]com

PhishDestroy identifies 10487-trezor.com as an elevated risk domain engaged in brand impersonation, specifically targeting Trezor users. This domain poses a concrete threat by mimicking the legitimate Trezor website to harvest cryptocurrency wallet credentials and seed phrases, potentially leading to asset theft. The page title "Index of /" suggests a minimal or default configuration, typical of phishing setups that redirect or serve malicious content.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports 7 out of 95 security vendors flagging this domain, reflecting broad industry consensus on its danger. The domain is registered through OwnRegistrar, Inc., and resolves to the IP address 188.114.97.3, which is associated with Cloudflare infrastructure. Domain creation on November 30, 2025, and its appearance on 1 security blocklist underscore its recent and suspicious nature. Notably, it possesses an SSL certificate from Google Trust Services (WE1), which may give users a false sense of security but does not validate the site's legitimacy. The domain's current offline status indicates it was taken down, but similar domains may reappear.

Users who encounter 10487-trezor.com or similar domains should never enter personal information, credentials, or seed phrases. Always verify the official Trezor URL, which is wallet.trezor.io, and enable two-factor authentication on all crypto accounts. If credentials were entered, immediately transfer funds to a new wallet, change passwords, and contact Trezor support. Report the domain to anti-phishing organizations and consider using browser security extensions. PhishDestroy recommends staying vigilant against brand impersonation attacks that leverage lookalike domains and SSL certificates to deceive users.