trezor-safe[.]at

trezor-safe.at is currently active and hosts a webpage whose title reads “Site is being set up…”. The domain resolves to 107.189.23.176, which belongs to AS14956 (RouterHosting LLC) located in the Netherlands. Authoritative name servers are a.dnspod.com, b.dnspod.com and c.dnspod.com, and the web server reports Nginx with HTTP Strict Transport Security enabled. The site presents a valid Let’s Encrypt certificate issued for the first year of registration. Infrastructure analysis indicates the domain is being used for brand impersonation of the cryptocurrency hardware wallet provider Trezor. The domain appears on three security blocklists (PhishDestroy, MetaMask, SEAL) and receives a Gridinsoft trust score of 0 / 100. VirusTotal scans show 13 of 91 security vendors flagged the domain. No additional payloads, scripts, or credential‑collection pages have been observed; the public page content is limited to the placeholder title. The presence on multiple blocklists, low trust score, and the explicit brand‑impersonation claim justify a high risk rating. Defenders should add the domain to URL filtering, block the IP address, and monitor DNS queries for the associated name servers. Continuous re‑evaluation is recommended in case the site transitions from a placeholder page to a credential‑harvesting interface.