trezorapiscan[.]com

On July 23, 2026, the domain trezorapiscan.com was observed to be offline but retains indicators of a recent crypto‑related brand‑impersonation campaign targeting Trezor users. The domain was registered on September 11, 2025 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare, resolving to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. DNS resolution uses the Cloudflare authoritative name servers lily.ns.cloudflare.com and mitch.ns.cloudflare.com, confirming the use of Cloudflare’s edge network for traffic handling. No TLS certificate was presented for the domain, meaning HTTPS connections would be unavailable or would fall back to HTTP, a characteristic often observed in hastily deployed malicious sites. The page title returned by the HTTP request is “Just a moment…”, providing no further context about the page’s purpose.

Threat intelligence sources have classified the activity as a crypto scam, and the domain appears on a single security blocklist. The Gridinsoft trust score is 0 out of 100, indicating an extremely low reputation. VirusTotal analysis shows that eight out of ninety‑five security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. The domain is also listed as blocked by the PhishDestroy service, which suggests that at least one anti‑phishing organization has taken action to prevent user access.

While the offline status prevents real‑time interaction, the combination of a recent registration date, lack of SSL, low trust score, and multiple vendor detections points to a purposeful attempt to impersonate the Trezor brand for cryptocurrency‑related fraud. Uncertainty remains regarding the exact payload or phishing kit used, as no samples or page content have been released publicly. Defenders should continue to monitor the IP address 188.114.97.