en-trezor[.]io

Analysis of en-trezor.io shows a newly registered domain (created February 21, 2026) that is being used to impersonate the hardware‑wallet brand Trezor in a crypto‑scam campaign. The domain resolves to IP address 188.114.96.3, which is allocated to Cloudflare, Inc. (AS13335) and geolocated in the United States. The SSL certificate associated with the site is identified by the label WE1, indicating a valid TLS handshake but providing no assurance of legitimacy. Reputation data is uniformly negative: AlienVault OTX has cited the domain in sixteen separate threat‑intel pulses, and it appears on one security blocklist.

The Gridinsoft trust score is the minimum possible, 0 out of 100, and the domain is listed as blocked by the PhishDestroy service. VirusTotal scans reveal that nineteen of ninety‑three security vendors flagged the domain as malicious, reinforcing the suspicion of a fraudulent operation. The current operational status is offline, which may be a temporary takedown or a shift to a new hosting location.

While the exact page content, title, and internal structure have not been captured, the aggregation of threat‑intel signals—multiple OTX references, blocklist presence, low trust score, vendor detections, and confirmed impersonation of Trezor—provides a clear indication of malicious intent. Defenders should add en-trezor.io to all internal block and alert lists, monitor for any re‑appearance of the domain or related subdomains, and enforce strict email and web filtering rules for any communications claiming to originate from Trezor that reference this domain. Continuous observation of the associated IP (188.114.96.3) is advised, as Cloudflare often serves as a shared infrastructure for multiple malicious actors.