en-trezorsuite[.]org

The domain en-trezorsuite.org was registered on July 28, 2026 and is currently active. Infrastructure analysis shows it resolves to the IPv4 address 45.74.7.27 and is hosted under the name servers ns1.amper.host and ns2.amper.host. Registration data lists Hosting Concepts B.V. d/b/a Registrar.eu as the registrar, indicating a likely European‑based registration service. The domain has been added to a single security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one reputable feed considers it malicious.

VirusTotal has processed the domain and 10 of 91 security vendors returned a positive detection, reinforcing the suspicion of malicious activity. The threat type is identified as a crypto drainer, suggesting the site is designed to illicitly extract cryptocurrency assets from victims. No public page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are available in the current intelligence set, leaving those vectors unverified at this time.

Analysts should treat en-trezorsuite.org as a high‑risk indicator and enforce block‑at‑network perimeter rules for the IP 45.74.7.27 and the domain itself. Continuous monitoring of the registrar’s WHOIS records and the associated name servers is advised to detect any changes that might signal further expansion of the infrastructure. Organizations should also update endpoint and email security solutions with the domain’s indicator of compromise and ensure that any cryptocurrency transaction monitoring tools flag interactions with the domain or its resolved IP address.