Skip to content

[False Negative]: add 34 phishing domains (trezosuiteapp[.]vercel[.]app, tfjg-rjgu-egji-zjgi-orjg-rngj[.]netlify[.]app, ...) #142

Closed
Closed
[False Negative]: add 34 phishing domains (trezosuiteapp[.]vercel[.]app, tfjg-rjgu-egji-zjgi-orjg-rngj[.]netlify[.]app, ...)#142
Assignees
sefinek
Labels
suggestionSome suggestion

Description

@ninjacatcher
ninjacatcher
opened on Dec 18, 2025

Important

Executive Summary

This report documents 34 domain(s) that have been identified as part of active phishing operations. These domains exhibit characteristics consistent with malicious infrastructure and pose an immediate security risk to internet users.

The following 34 domain(s) have been analyzed and confirmed as participating in phishing campaign(s):

trezosuiteapp.vercel.app
tfjg-rjgu-egji-zjgi-orjg-rngj.netlify.app
ldgerlive.us
trezorsuite.at
home-leger-desktop.framer.ai
get-trezzore.framer.ai
get-treezr-suit-en.framer.media
app-ledger-desktop.wasmer.app
us-ledgredesktop.framer.ai
ledgerapp.created.app
ledgersso.created.app
ledger-wallet.gitlab.io
sute-trezr.created.app
tronssan.github.io
aomicwallet.github.io
www.exodusl.com
tfjg-rjgu-eeti-zjti-ordg-rfgj.netlify.app
c066b573.smrta.pages.dev
ad.exodus.build
webapp.ghost.io
eng-treezorsute.framer.ai
started-trezo.framer.ai
live-desktop-leidgr.framer.ai
webassetsapp.ghost.io
live-desktop-ledgr.framer.ai
ledgercom.m-teach.com
engsuites.ghost.io
home-tzersuite.framer.ai
suites-en.framer.ai
hub-desktop-ladgr.framer.ai
createwebsite.ghost.io
guide-ledegr.framer.media
appsuites.framer.ai
apptreezorsuite.github.io

Threat Analysis

Phishing Attack Details

These domains are part of a phishing campaign targeting cryptocurrency companies and cryptocurrency holders/investors.
Attackers may use fake login pages, fake Web3 wallet connection prompts, fake cryptocurrency exchange/swap interfaces, or modified/malicious software to steal cryptocurrency seed phrases/keys.

Technical Details

  • No sophisticated cloaking detected.

Detections & Targeted Brands

Diagrams

Phishing Campaign Mindmap Overview 
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#f97316', 'primaryTextColor': '#ffffff', 'primaryBorderColor': '#ea580c', 'lineColor': '#fb923c', 'secondaryColor': '#fed7aa', 'tertiaryColor': '#fff7ed'}}}%%
mindmap
    root((Phishing Campaign<br/>34 domains))
        ))TARGETS((
            ["Trezor Wallet"]
                (trezosuiteapp.vercel.app)
                (tfjg-rjgu-egji-zjgi-orjg-rngj.netlify.app)
                (get-trezzore.framer.ai)
                (get-treezr-suit-en.framer.media)
                (sute-trezr.created.app)
                (tfjg-rjgu-eeti-zjti-ordg-rfgj.netlify.app)
                (c066b573.smrta.pages.dev)
                (webapp.ghost.io)
                (eng-treezorsute.framer.ai)
                (started-trezo.framer.ai)
                (webassetsapp.ghost.io)
                (engsuites.ghost.io)
                (home-tzersuite.framer.ai)
                (suites-en.framer.ai)
                (createwebsite.ghost.io)
            ["Ledger"]
                (home-leger-desktop.framer.ai)
                (app-ledger-desktop.wasmer.app)
                (us-ledgredesktop.framer.ai)
                (ledgerapp.created.app)
                (ledgersso.created.app)
                (ledger-wallet.gitlab.io)
                (live-desktop-leidgr.framer.ai)
                (live-desktop-ledgr.framer.ai)
                (ledgercom.m-teach.com)
                (hub-desktop-ladgr.framer.ai)
                (guide-ledegr.framer.media)
                (appsuites.framer.ai)
                (apptreezorsuite.github.io)
            ["Exodus"]
                (www.exodusl.com)
                (ad.exodus.build)
            ["Ledger Live"]
                (ldgerlive.us)
            ["Tronscan"]
                (tronssan.github.io)
            ["Atomic Wallet"]
                (aomicwallet.github.io)
        ))INFRASTRUCTURE((
            {{"AS16509 Amazon.com"}}
                64.29.17.3
                216.198.79.3
                35.157.26.135
                63.176.8.218
                35.71.142.77
                52.223.52.2
                216.150.1.129
                216.150.1.1
                216.150.1.193
                216.150.16.65
            {{"AS54113 Fastly"}}
                185.199.111.153
                185.199.109.153
                185.199.108.153
                185.199.110.153
                151.101.3.7
                151.101.67.7
                151.101.131.7
                151.101.195.7
            {{"AS13335 Cloudflare"}}
                104.21.37.76
                172.67.205.227
                188.114.96.3
                188.114.97.3
                104.21.25.106
                172.67.134.5
            {{"AS46606 Unified Layer"}}
                162.241.123.35
            {{"AS214822 MT FINANCE"}}
                62.76.228.226
            {{"AS12876 SCALEWAY S.A.S."}}
                62.210.172.151
            {{"AS396982 Google"}}
                35.185.44.232
        ))REGISTRARS((
            ("CSC Corporate Domains, Inc")
            ("Tucows Domains Inc")
            ("Squarespace Domains II LLC")
            ("NameCheap, Inc")
            ("Name.com, Inc")
            ("Gransy s.r.o")
Loading
Phishing Campaign Full Overview (v1) 
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#6366f1', 'primaryTextColor': '#ffffff', 'primaryBorderColor': '#4f46e5', 'lineColor': '#a5b4fc', 'secondaryColor': '#e0e7ff', 'tertiaryColor': '#eef2ff'}}}%%
flowchart LR
    subgraph BRANDS["TARGET BRANDS"]
        direction TB
        B1["Trezor Wallet"]
        B2["Ledger"]
        B3["Exodus"]
        B4["Ledger Live"]
        B5["Tronscan"]
        B6["Atomic Wallet"]
    end

    subgraph DOMAINS["PHISHING DOMAINS"]
        direction TB
        D1([trezosuiteapp.vercel.app])
        D2([tfjg-rjgu-egji-zjgi-orjg-rngj.netlify.app])
        D3([ldgerlive.us])
        D4([trezorsuite.at])
        D5([home-leger-desktop.framer.ai])
        D6([get-trezzore.framer.ai])
        D7([get-treezr-suit-en.framer.media])
        D8([app-ledger-desktop.wasmer.app])
        D9([us-ledgredesktop.framer.ai])
        D10([ledgerapp.created.app])
        D11([ledgersso.created.app])
        D12([ledger-wallet.gitlab.io])
        D13([sute-trezr.created.app])
        D14([tronssan.github.io])
        D15([aomicwallet.github.io])
        D16([www.exodusl.com])
        D17([tfjg-rjgu-eeti-zjti-ordg-rfgj.netlify.app])
        D18([c066b573.smrta.pages.dev])
        D19([ad.exodus.build])
        D20([webapp.ghost.io])
        D21([eng-treezorsute.framer.ai])
        D22([started-trezo.framer.ai])
        D23([live-desktop-leidgr.framer.ai])
        D24([webassetsapp.ghost.io])
        D25([live-desktop-ledgr.framer.ai])
        D26([ledgercom.m-teach.com])
        D27([engsuites.ghost.io])
        D28([home-tzersuite.framer.ai])
        D29([suites-en.framer.ai])
        D30([hub-desktop-ladgr.framer.ai])
        D31([createwebsite.ghost.io])
        D32([guide-ledegr.framer.media])
        D33([appsuites.framer.ai])
        D34([apptreezorsuite.github.io])
    end

    subgraph SPACER1[" "]
        direction TB
        S1[ ]
        S2[ ]
    end

    subgraph HOSTING["HOSTING INFRASTRUCTURE"]
        direction TB

        subgraph CF["AS16509 Amazon.com"]
            IP1{{64.29.17.3}}
            IP2{{216.198.79.3}}
            IP3{{35.157.26.135}}
            IP4{{63.176.8.218}}
            IP5{{35.71.142.77}}
            IP6{{52.223.52.2}}
            IP7{{216.150.1.129}}
            IP8{{216.150.1.1}}
            IP9{{216.150.1.193}}
            IP10{{216.150.16.65}}
        end

        subgraph NC["AS54113 Fastly"]
            IP11{{185.199.111.153}}
            IP12{{185.199.109.153}}
            IP13{{185.199.108.153}}
            IP14{{185.199.110.153}}
            IP15{{151.101.3.7}}
            IP16{{151.101.67.7}}
            IP17{{151.101.131.7}}
            IP18{{151.101.195.7}}
        end

        subgraph LN["AS13335 Cloudflare"]
            IP19{{104.21.37.76}}
            IP20{{172.67.205.227}}
            IP21{{188.114.96.3}}
            IP22{{188.114.97.3}}
            IP23{{104.21.25.106}}
            IP24{{172.67.134.5}}
        end

        subgraph HO["AS46606 Unified Layer"]
            IP25{{162.241.123.35}}
        end

        subgraph MR["AS214822 MT FINANCE"]
            IP26{{62.76.228.226}}
        end

        subgraph GC["AS12876 SCALEWAY S.A.S."]
            IP27{{62.210.172.151}}
        end

        subgraph AZ["AS396982 Google"]
            IP28{{35.185.44.232}}
        end
    end

    subgraph SPACER2[" "]
        direction TB
        S3[ ]
        S4[ ]
    end

    subgraph REGISTRARS["REGISTRARS"]
        direction TB
        R1[("CSC Corporate Domains, Inc")]
        R2[("Tucows Domains Inc")]
        R3[("Squarespace Domains II LLC")]
        R4[("NameCheap, Inc")]
        R5[("Name.com, Inc")]
        R6[("Gransy s.r.o")]
    end

    B1 -.-> D1
    B1 -.-> D2
    B4 -.-> D3
    B2 -.-> D5
    B1 -.-> D6
    B1 -.-> D7
    B2 -.-> D8
    B2 -.-> D9
    B2 -.-> D10
    B2 -.-> D11
    B2 -.-> D12
    B1 -.-> D13
    B5 -.-> D14
    B6 -.-> D15
    B3 -.-> D16
    B1 -.-> D17
    B1 -.-> D18
    B3 -.-> D19
    B1 -.-> D20
    B1 -.-> D21
    B1 -.-> D22
    B2 -.-> D23
    B1 -.-> D24
    B2 -.-> D25
    B2 -.-> D26
    B1 -.-> D27
    B1 -.-> D28
    B1 -.-> D29
    B2 -.-> D30
    B1 -.-> D31
    B2 -.-> D32
    B2 -.-> D33
    B2 -.-> D34

    D1 --> S1
    S1 --> IP1
    D2 --> S2
    S2 --> IP2

    D2 --> IP3
    D2 --> IP4
    D3 --> IP25
    D4 --> IP26
    D5 --> IP5
    D5 --> IP6
    D6 --> IP5
    D6 --> IP6
    D7 --> IP6
    D7 --> IP5
    D8 --> IP27
    D9 --> IP6
    D9 --> IP5
    D10 --> IP7
    D10 --> IP8
    D11 --> IP9
    D11 --> IP8
    D12 --> IP28
    D13 --> IP8
    D13 --> IP10
    D14 --> IP11
    D14 --> IP12
    D14 --> IP13
    D14 --> IP14
    D15 --> IP12
    D15 --> IP11
    D15 --> IP14
    D15 --> IP13
    D16 --> IP19
    D16 --> IP20
    D17 --> IP3
    D17 --> IP4
    D18 --> IP21
    D18 --> IP22
    D19 --> IP22
    D19 --> IP21
    D20 --> IP15
    D20 --> IP16
    D20 --> IP17
    D20 --> IP18
    D21 --> IP6
    D21 --> IP5
    D22 --> IP5
    D22 --> IP6
    D23 --> IP5
    D23 --> IP6
    D24 --> IP18
    D24 --> IP16
    D24 --> IP17
    D24 --> IP15
    D25 --> IP6
    D25 --> IP5
    D26 --> IP23
    D26 --> IP24
    D27 --> IP15
    D27 --> IP16
    D27 --> IP17
    D27 --> IP18
    D28 --> IP5
    D28 --> IP6
    D29 --> IP6
    D29 --> IP5
    D30 --> IP5
    D30 --> IP6
    D31 --> IP18
    D31 --> IP15
    D31 --> IP17
    D31 --> IP16
    D32 --> IP5
    D32 --> IP6
    D33 --> IP6
    D33 --> IP5
    D34 --> IP11
    D34 --> IP14
    D34 --> IP12
    D34 --> IP13

    IP1 --> S3
    S3 --> R1
    IP28 --> S4
    S4 --> R1

    D1 --- R2
    D2 --- R5
    D3 --- R4
    D4 --- R6
    D5 --- R1
    D6 --- R1
    D7 --- R1
    D8 --- R3
    D9 --- R1
    D10 --- R2

    classDef brandStyle fill:#dc2626,stroke:#991b1b,stroke-width:2px,color:#fff
    classDef domainStyle fill:#7c3aed,stroke:#5b21b6,stroke-width:2px,color:#fff
    classDef ipStyle fill:#0891b2,stroke:#0e7490,stroke-width:2px,color:#fff
    classDef registrarStyle fill:#d97706,stroke:#b45309,stroke-width:2px,color:#fff
    classDef invisible fill:none,stroke:none,color:transparent
    classDef invisibleSubgraph fill:none,stroke:none
    class B1,B2,B3,B4,B5,B6 brandStyle
    class D1,D2,D3,D4,D5,D6,D7,D8,D9,D10,D11,D12,D13,D14,D15,D16,D17,D18,D19,D20,D21,D22,D23,D24,D25,D26,D27,D28,D29,D30,D31,D32,D33,D34 domainStyle
    class IP1,IP2,IP3,IP4,IP5,IP6,IP7,IP8,IP9,IP10,IP11,IP12,IP13,IP14,IP15,IP16,IP17,IP18,IP19,IP20,IP21,IP22,IP23,IP24,IP25,IP26,IP27,IP28 ipStyle
    class R1,R2,R3,R4,R5,R6 registrarStyle
    class S1,S2,S3,S4 invisible
    class SPACER1,SPACER2 invisibleSubgraph

    linkStyle 33,34,35,36,113,114,115,116 stroke:none
Loading
Phishing Campaign Registrars Pie Chart 
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#6366f1', 'pieStrokeColor': '#1e1b4b', 'pieStrokeWidth': '2px', 'pieSectionTextColor': '#ffffff', 'pieLegendTextColor': '#1e1b4b', 'pieOuterStrokeColor': '#312e81'}}}%%
pie showData
    title Domain Registrars Distribution
    "CSC Corporate Domains, Inc" : 4
    "Tucows Domains Inc" : 2
    "Squarespace Domains II LLC" : 1
    "NameCheap, Inc" : 1
    "Name.com, Inc" : 1
    "Gransy s.r.o" : 1
Loading
Phishing Campaign ASN Hosting Pie Chart 
%%{init: {'theme': 'base', 'themeVariables': {'primaryColor': '#6366f1', 'pieStrokeColor': '#1e1b4b', 'pieStrokeWidth': '2px', 'pieSectionTextColor': '#ffffff', 'pieLegendTextColor': '#1e1b4b', 'pieOuterStrokeColor': '#312e81'}}}%%
pie showData
    title ASN Hosting Distribution
    "AS16509 Amazon.com" : 19
    "AS54113 Fastly" : 7
    "AS13335 Cloudflare" : 4
    "AS46606 Unified Layer" : 1
    "AS214822 MT FINANCE" : 1
    "AS12876 SCALEWAY S.A.S." : 1
    "AS396982 Google" : 1
Loading

Screenshots

(Screenshots for some scans may not display or may not contain complete or correct content for various reasons, which can be seen on the specific scan page)

Screenshots

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Screenshot

Scans

Report Metadata
ID: bffe3f3eac0bbce84aa | Timestamp: 18.12.2025 09:36:02 UTC | Domains: 34 | (Total) Detections: VT: 186 | Spamhaus: 1 | APVA: 31 | Attack Vector: Phishing

Metadata

Metadata

Assignees

Labels

suggestionSome suggestion

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions