trezor[.]io-app[.]online

On 25 July 2026, the domain trezor.io-app.online was observed hosting a brand‑impersonation page that claimed to be the “Trezor Suite App (Official)”. The site was registered on 21 February 2026 and resolved to the IPv4 address 66.33.60.129, which is allocated to Amazon.com, Inc. (AS16509) in the United States. VirusTotal recorded 12 detections out of 93 scanning engines, indicating that a minority of security products flagged the domain as malicious. The SSL certificate was identified with the rating “R10”, and the Gridinsoft trust score was 0 / 100, reflecting a lack of trustworthiness.

The domain was listed on a single security blocklist and was actively taken down by the PhishDestroy mitigation service; its current HTTP status is offline. The page title explicitly references the Trezor brand, confirming the impersonation of the hardware‑wallet provider. The campaign is classified as a crypto‑scam, consistent with the use of the Trezor brand to lure cryptocurrency users. Defenders should immediately add 66.33.60.129 to deny‑list rules, enforce DNS filtering for the trezor.io‑app.online suffix, and monitor for newly registered domains that combine the “trezor” keyword with the “io‑app.online” TLD pattern.

Network‑level controls should include blocking traffic to the identified ASN (AS16509) when it originates from suspicious URLs. Threat‑intel feeds should be updated to reflect the 12 VirusTotal detections and the 0 / 100 Gridinsoft score, and security appliances should be instructed to treat any future resolution of this domain as malicious. Continuous review of phishing‑related blocklists is advised, as the low blocklist count suggests that broader community awareness may still be limited.