The full anatomy of a phishing site,
one URL at a time.
ZeroPhish renders the page, runs twelve detection signals against the DOM, certificate chain, brand fingerprint and threat feeds, and returns a typed verdict. Built for security teams and product engineers.
Phishing detected
| URL | hxxps://app-trzor-suite-cdn[.]github[.]io/en-us/ | |
| Brand | Trezor | |
| Screenshot | https://cdn.zerophish.ai/0ba47767-5a27-4101-ac50-0d508051dd7f.jpg | |
| Scan ID | 90743167-1e27-4546-a0fa-ec1989964ef9 |
No detection signals on this scan — it predates the signal pipeline. Re-analyze to capture them.
No brand impersonation signals available.
No technical metadata captured for this scan.
The site appears to be a phishing site for several reasons.
-
Suspicious URL: The URL does not match the legitimate Trezor domain (trezor.io). Instead, it is hosted on github.io, which is commonly used by attackers for phishing.
-
Misleading Information: The site’s HTML contains multiple instances of
onclick="getdata()", which could be used to collect sensitive user data. Additionally, this function is not defined anywhere in the provided HTML, which makes the site more suspicious. -
Imitation of a Legitimate Brand: The site tries to imitate the official Trezor site by creating a page that looks like the official Trezor Suite page, which might trick users into thinking that they are on the official page.
-
Inaccurate Information: The text ‘Copyright belongs to company s.r.o.’ is vague and indicates an attempt to look authentic without the necessary details.