web-trezzor-ios[.]vercel[.]app

The domain web-trezzor-ios.vercel.app is currently active and identified as a crypto wallet drainer phishing site. Analysis indicates the infrastructure is designed to mimic legitimate cryptocurrency wallet services, likely targeting users of the Trezor hardware wallet or related software. The page title 'Deployment Unavailable' suggests an attempt to disguise malicious activity as a technical error, a common tactic to evade suspicion while harvesting credentials or private keys. Infrastructure analysis reveals the domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation timestamp that may indicate domain spoofing or manipulation. The domain resolves to IP address 216.198.79.67, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. Security vendors have flagged this domain, with 21 of 95 VirusTotal engines detecting malicious activity. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WR1), a legitimate provider, which may lend false credibility to the phishing page. As of the latest verification, the domain remains active and continues to pose a high risk to users. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with this domain should immediately revoke any wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Security teams should treat this domain as part of a broader crypto-theft campaign and correlate with other known drainer infrastructure for comprehensive mitigation.