The advice I repeat most often on this blog is: look at the domain after the @. Most of the scams I write about here fall apart the moment you do it. Then came a case in September where that check passes cleanly, the sender really is the brand, and the email is still phishing.
What actually happened?
On 9 September 2026, Trezor published an incident report about Brevo, the third-party marketing platform it uses to send newsletter campaigns. Someone got into Brevo and used it to send email from customer accounts, Trezor's among them.
The numbers, from Trezor's own post: the incident affected its opt-in newsletter database of roughly 347,000 email addresses, and the phishing message went out to 347,000 customers. The subject line was "Critical Security Alert: STM32 Entropy Vulnerability". The link led to an app that asked people to type in their wallet backup, which is the phrase that controls every coin in the wallet.
Trezor says it took the domain down at the DNS level within 20 minutes, which limited access to the 2,500 people who had already clicked. Twenty minutes is a fast response by any standard. Two and a half thousand people still got there first.
Trezor was not alone. Malwarebytes Labs describes the same wave hitting customers of other crypto-hardware brands. TechCrunch quotes Brevo's own status post saying 138 Brevo accounts were accessed, through access that was "not properly scoped" and wrongly reached beyond the organization it was meant for. Trezor's post puts the number at 120 accounts. The two figures come from different write-ups on different days, so I'm giving you both rather than picking a favourite.
Why did the sender address look perfect?
Because it was perfect. Nothing was spoofed.
Big brands don't send a 347,000-recipient newsletter from someone's laptop. They hand the list to a marketing platform, and that platform sends on the brand's behalf, from the brand's domain, with the brand's mail records saying "yes, this sender is authorised". That is the normal, correct setup, and it's what makes newsletters land in your inbox instead of your spam folder.
So when the platform itself is compromised, the attacker inherits all of it. Real sender domain. Real authentication. Real list of people who genuinely are customers of that brand. Your mail app has nothing to complain about, because on paper nothing is wrong. 😅
trezor.iothe sender domain, genuinely the brand'sexample[.]comillustration: the page that asked for the wallet backupDoesn't that break the whole "check the domain" habit?
No, but it moves it. The domain you need to read is the one at the other end of the link, not the one after the @.
And here is the detail I find genuinely interesting. Trezor explains that it could kill the phishing domain in 20 minutes "because Brevo routes all communication via our domain". Which cuts both ways: it gave Trezor the power to pull the plug, and it means the link in the message wouldn't have looked alien either at first glance. The address that mattered was the one the click ended at, after the redirect, not the one printed in the email.
Of course, that's harder work than glancing at a sender name. Which is why the second check below matters at least as much as the first one.
What was the message actually asking for?
Your wallet backup. The recovery phrase. The one string of words that hands over everything.
This is the check that doesn't care who sent the email, how real the domain is, or how alarming the subject line sounds. Nobody legitimate asks for it. Not the wallet maker, not the bank, not the support agent, not the "security team" on a deadline.
| The check | What it tells you | Did it help here? |
|---|---|---|
| Sender domain after the @ | Whether the mail came from the brand's own domain | No, the domain was genuinely theirs |
| Lookalike spelling | Whether the domain imitates a known brand | No, there was nothing misspelled to catch |
| Where the link ends up | The address that actually receives what you type | Partly, the destination is the thing that mattered |
| What the message asks for | Whether anyone legitimate would ever ask for it | Yes, a recovery phrase request is always the answer |
So what do you do with a message like this?
- Don't click to "just look". A page that asks for a recovery phrase only needs you curious for about fifteen seconds.
- Copy the link's address instead. Long-press on a phone, right-click and "Copy link address" on a computer. Now you can read it without visiting it.
- Read the domain just before the first single slash. That's the part that decides who owns the page. Everything after it is decoration.
- Paste that domain into a checker and see whether it's a lookalike, whether it's been reported, and how old the registration is.
- Then ignore the link anyway. Open the account through your own bookmark or the app you already have installed. If there really is a critical security alert, it will be there too.
- Never type a recovery phrase into anything. Not a website, not a support chat, not an app that claims to verify it. There is no legitimate version of that request.
How does IP Tracker fit in here?
IP Tracker is my free Chrome extension. Paste a domain or a full email address into the popup and it gives you a plain-English read: 50 checks a day, no account, no tracking, and only the value you paste gets looked up.
For a message like this one, it helps with the link's destination rather than the sender. Paste the domain you copied and it compares the spelling against the official domains of roughly 125 widely impersonated brands (banks, payment services, couriers, big tech, government sites, crypto services, streaming), checks Google's list of reported dangerous sites, shows how many security vendors flag it on VirusTotal, and shows the domain's registration date. A domain registered four days ago that's asking for your credentials is a combination worth pausing on. 🤓
What can't it do?
Being honest about this matters more than sounding useful, so here's the uncomfortable list.
- It would have said nothing was wrong with that sender. Paste the sender address from a breached-platform email and the domain check comes back clean, because the domain is clean. It's the brand's real domain. The tool would be reporting the truth, and the truth would be unhelpful.
- It doesn't open links or follow redirects. It checks the domain you paste. If the link bounces through a tracking address before landing somewhere else, you have to get to the final destination yourself.
- It doesn't read your inbox. There's no mailbox scanning, no attachment analysis, no "this email is safe" verdict. You paste, it checks, that's the whole relationship.
- The lookalike list is about 125 brands. The most impersonated ones, not every brand. Trezor is on that list, but a smaller or more niche brand may not be, and then a lookalike of it will not be flagged at all.
- Blocklists lag. A phishing domain that went live an hour ago has usually been reported by nobody yet. In an incident that was over in 20 minutes, that lag is the whole story.
Unfortunately, this kind of incident isn't going away, because the weak point isn't the brand's own security. It's the long chain of companies that send mail on its behalf. You can't audit that chain, and neither can I.
What you can do is change which question you ask. Not "is this really from them?" That one has stopped being decisive. Ask "where does this link actually go, and what is it asking me to hand over?" Those two still work when the sender is genuine. 😉
To summarize:
- ✓ A real sender address proves the mail's origin, not its intent.
- ✓ Copy the link instead of clicking, and read the domain before the first single slash.
- ✓ Check that domain: lookalike spelling, reported status, registration age.
- ✓ Better still, ignore the link and use your own bookmark or app.
- ✓ Never type a recovery phrase or password into a page a message sent you to.
Happy checking! 😎
Sources
- Security incident at Brevo, our third-party email provider, Trezor (10 September 2026)
- Scammers target hundreds of thousands of crypto owners after Trezor confirms data breach of email provider, TechCrunch (11 September 2026)
- Crypto customers targeted by scammers after email marketing provider breach, Malwarebytes Labs (September 2026)