trezor[.]support

The domain trezor.support was observed hosting a page titled "Trezor Hardware Wallet (Official) | Bitcoin & Crypto Security," a clear indication of brand impersonation targeting the Trezor hardware wallet. Registration was handled by Name.com, Inc., and the domain resolves to the IP address 172.66.137.111, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain’s authoritative name servers are ns4lrt.name.com, ns1dnx.name.com, ns3bgq.name.com, and ns2fgv.name.com, all of which are typical of Name.com’s DNS infrastructure. No SSL certificate is present, meaning HTTPS connections are not established for the site.

VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, and it appears on two security blocklists. Additional reputation services have marked the site as malicious: PhishDestroy and Enkrypt have blocked it, while Gridinsoft assigns a trust score of zero out of one hundred. The site’s current status is offline, indicating that the malicious content has been taken down or the hosting has been terminated.

Despite the takedown, the observed infrastructure—Cloudflare‑backed IP, Name.com registration, and lack of TLS—provides a reproducible pattern for future impersonation attempts. Defenders should continue to monitor the domain for re‑registration, enforce blocking of the IP address and associated name servers, and add trezor.support to threat intel feeds. Organizations using Trezor products should alert users to verify URLs and avoid entering credentials on sites lacking proper TLS certificates, especially those presenting the exact brand name in the page title without official endorsement.