helpsuitetrezo-portal[.]wasmer[.]app

The domain helpsuitetrezo-portal.wasmer.app was identified as a brand impersonation threat specifically targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates this infrastructure was designed to facilitate crypto drainer attacks, where victims are tricked into connecting wallets to malicious smart contracts that siphon funds. The domain is currently offline, but prior activity and detection metrics confirm its malicious intent. Infrastructure analysis reveals the domain was flagged by 20 of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. It resolved to the IP address 62.210.172.151 and was registered through Squarespace Domains II LLC. The domain appeared on one security blocklist and had a Gridinsoft trust score of 0/100, further corroborating its threat status. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend false legitimacy to phishing sites. The page title, 'Trezor Suite: Complete Guide,' was crafted to mimic official Trezor documentation, increasing the likelihood of deception. Current status confirms the domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP at the network level. Users who visited the site should assume wallet compromise and immediately transfer assets to a new, secure wallet. Monitoring for unauthorized transactions and revoking any connected dApp permissions is critical. Security teams should treat this domain as part of a broader crypto drainer campaign and correlate with other Trezor-themed impersonation attempts.