suite-trezor[.]at

Analysis of the domain suite-trezor.at, observed on 19 July 2026, classifies it as a high‑risk brand‑impersonation site targeting the cryptocurrency hardware‑wallet provider Trezor. The domain resolves to IP 94.183.168.63, which is hosted by FrostyHosting in Russia. VirusTotal scans recorded 17 out of 91 security vendors raising alerts, and the host appears on three public blocklists; it has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. HTTP requests return a 403 status code and the page title returned by the server is “Attention Required! | Cloudflare”, indicating that Cloudflare is presently serving an access‑denied page, consistent with the reported offline status. No additional page content has been published, so the specific lure, credential‑capture form, or malicious payload cannot be confirmed. The observable indicators are limited to the domain name, IP address, hosting location, detection counts, and blocklist entries. Defenders should immediately add suite-trezor.at and 94.183.168.63 to network‑level deny lists, monitor for any future resurrection of the domain, and consider sharing the indicator set with upstream threat‑intel feeds. Continuous DNS and IP reputation monitoring is advised to detect potential re‑hosting of the infrastructure.