trezext[.]live

This domain, trezext.live, poses a direct threat as a brand impersonation portal designed to mimic the official Trezor cryptocurrency wallet interface. Analysis of the page title, "Welcome | Trezor Suite," indicates an attempt to deceive users into entering sensitive credentials or recovery phrases under the false pretense of accessing their wallet. Such impersonation schemes are commonly associated with cryptocurrency drainers, where stolen credentials or seed phrases are used to siphon funds from victims' wallets without authorization. The domain's infrastructure and content alignment with Trezor's branding suggest a deliberate effort to exploit trust in the targeted brand for financial gain. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in phishing campaigns. It resolves to the IP address 162.241.85.93, hosted within AS46606 (Unified Layer) in the United States, and currently lacks an SSL certificate, further reducing its legitimacy. Detection metrics reinforce its malicious classification, with 18 out of 95 security vendors on VirusTotal flagging the domain as harmful. Additionally, the domain appears on three distinct security blocklists, and it has been proactively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Users who visited trezext.live or interacted with its content should assume their credentials or recovery phrases may have been compromised. Immediate actions include revoking any active wallet sessions, transferring funds to a new wallet with a fresh recovery phrase, and monitoring all linked accounts for unauthorized transactions. It is also recommended to scan local devices for malware, as phishing portals may deploy additional payloads. Affected individuals should report the domain to relevant security teams and consider notifying their wallet provider to assist in broader threat mitigation efforts. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts using alternative domains or communication channels.