trezort[.]io

Analysis indicates that the domain trezort.io is actively impersonating Trezor, a well-known cryptocurrency hardware wallet provider. The domain was registered on February 12, 2022, through NameSilo, LLC, and currently resolves to the IP address 45.77.75.133. The page title, 'SoftwaresProtect — Cloud System Protection,' does not align with Trezor's typical branding or service offerings, suggesting an attempt to mislead visitors. Infrastructure analysis reveals the domain is hosted on a Let's Encrypt SSL certificate, a common choice for both legitimate and malicious sites due to its free availability. The domain appears on one security blocklist and has been flagged in two threat intelligence pulses on AlienVault OTX, further supporting its classification as malicious. Detection engines on VirusTotal have flagged the domain, with 2 out of 95 security vendors identifying it as harmful. While the exact content and functionality of the site have not been fully analyzed, the combination of domain registration details, resolving IP, and detection by security vendors strongly suggests brand impersonation targeting Trezor users. Defenders are advised to block access to this domain at the network level and monitor for related phishing attempts. Users encountering this domain should avoid interaction and report it to relevant security teams for further investigation.