trezordevices[.]io

This domain, trezordevices.io, presents a high-risk brand impersonation threat targeting users of Trezor hardware wallets. Analysis indicates the site was designed to mimic legitimate Trezor authentication portals, likely to harvest cryptocurrency wallet credentials, recovery seeds, or private keys. The infrastructure was structured to deceive users into believing they were interacting with an official Trezor service, potentially leading to unauthorized access and asset theft. Evidence supporting this assessment includes detection by 22 out of 95 security vendors on VirusTotal, placement on five security blocklists (PhishDestroy, Polkadot, Enkrypt, Codeesura, PhishingDB), and a domain creation date of February 21, 2026. The domain resolved to the IP address 158.94.210.251, hosted under AS202412 (Omegatech LTD) in the Netherlands, and used an SSL certificate issued by R12. The page title 'Just a moment...' suggests the use of anti-bot or cloaking techniques to evade automated security scans. Users who visited trezordevices.io should immediately revoke any active sessions, reset credentials associated with cryptocurrency wallets, and monitor accounts for unauthorized transactions. If recovery seeds or private keys were entered, affected wallets should be considered compromised, and funds should be transferred to a new, secure wallet. Devices used to access the site should undergo malware scans, and browser data should be cleared to remove any stored session tokens or cached content. Organizations should update blocklists to include this domain and its associated IP address to prevent further exposure.