jup[.]co[.]com[.]trezor-wallet[.]io

Analysis of jup.co.com.trezor-wallet.io shows a domain created on 21 February 2026 that is actively used to impersonate the hardware‑wallet brand Trezor in a crypto‑related scam. The domain resolves to IP address 185.208.156.66, which is registered to Global‑Data System IT Corporation in Switzerland (ASN 42624). The hosting infrastructure carries a zero‑trust rating from Gridinsoft (0/100) and presents an SSL certificate classified as R11, indicating a low‑confidence certificate that does not meet industry validation standards. VirusTotal scans have recorded six positive detections out of ninety‑three security vendors, reinforcing the malicious assessment.

The site is listed on at least one public blocklist and has been taken down by the PhishDestroy takedown service, confirming that it was previously active and recognized as a threat. The brand target is explicitly Trezor, and the scam type is identified as a crypto scam, meaning the domain likely attempted to harvest cryptocurrency credentials or private keys. Current online status is offline, so active monitoring of the hosting IP is advisable to detect any re‑hosting attempts.

Defensive actions should include adding the IP address 185.208.156.66 to network blocklists, updating intrusion‑prevention signatures with the observed trust‑score and SSL anomalies, and ensuring that endpoint security solutions flag any connections to this domain. Organizations that rely on Trezor hardware wallets should alert users to the existence of this impersonation attempt and reinforce the use of verified Trezor URLs. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related subdomains, and the domain’s registration details should be monitored for potential renewal or transfer that could enable future abuse.