Phishing detection: privacy-trezor.io

Trezor
https://privacy-trezor.io Access site
Screenshot
Screenshot of privacy-trezor.io
Investigate
Domain privacy-trezor.io0 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 2.58.56.150
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://privacy-trezor.io
urlscan Wayback archive.today
Cert YE1
crt.sh Censys Google CT
Phishunt analysis Beta
17 noiseheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +3.4 Shared IP cluster
  • +2.2 Country mismatch
  • +2.0 Site cluster
  • +1.1 No CSP header
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Final host mismatch
  • +0.5 Young certificate
  • +0.3 Free CA
  • +0.3 Long domain
  • +0.3 Suspicious TLD
  • +0.1 Hyphens
17 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

This domain references the Trezor cryptocurrency wallet brand but redirects visitors to Google, a cloaking technique likely used to hide the true phishing content from scanners while showing a fake Trezor page to targeted victims to harvest wallet credentials.

Final host mismatchHigh entropyCountry mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-26 · confidence 35%
Domain & Network
Whois
Network
IP 2.58.56.150
Country The NetherlandsThe Netherlands
Hosting 1337 Services GmbH
ASN AS210558
TLS Cert YE1
External detection No external source flags this
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign abc9907875c9 (3 domains · 3 hosts)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
appeal-coinbase.com 66 similar text same IP same redirect target appeared together (24h) same favicon same screenshot
active 2026-09-26
case-binance.us 62 similar text same IP same redirect target appeared together (7d) same favicon same screenshot
active 2026-09-19
microsoftoffice-o365.com 44 similar text same redirect target appeared together (72h) same favicon same screenshot
active 2026-09-23
authentication.citrix-sharing.com 40 similar text same redirect target same favicon same screenshot
active 2026-08-23
buscarmi-icloud.app 40 similar text same redirect target same favicon same screenshot
active 2026-09-07
Top 5 of 7 related · rebuilt daily · corr-1.3.0 · related infrastructure API
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-25 23:27 UTC  ·  Last refreshed 2026-09-27 03:30 UTC