trez0rsuite-suite[.]us

Analysis of trez0rsuite-suite.us indicates a short‑lived infrastructure designed to impersonate the Base brand. The domain was registered on 21 February 2026 through ENOM, INC. and resolves to the IPv4 address 23.254.240.243, which belongs to AS54290 Hostwinds LLC in the United States. The authoritative nameservers are ns61.hostwindsdns.com and ns62.hostwindsdns.com, both typical of Hostwinds‑hosted domains. No TLS certificate is presented; HTTP requests return no secure handshake, which is consistent with many low‑effort phishing deployments. The site’s only observable attribute is the HTML page title “Trezor Suite – Download Trezor Suite App – Trezor Suite”, suggesting the page attempts to lure users interested in the Trezor cryptocurrency hardware wallet.

The brand target field lists “base”, confirming the campaign’s intent to masquerade as a Base‑related service, possibly to harvest wallet credentials or seed phrases. The scam classification is recorded as “Wallet/Seed Phishing”. Reputation services have flagged the domain on three independent blocklists. VirusTotal reports that seven of ninety‑three scanning engines have raised detections, and the domain is explicitly blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft’s trust score of 0 / 100 further reinforces the malicious nature of the host. The domain’s current HTTP status is offline, indicating that the operators have taken the site down or are rotating infrastructure.

Uncertainty remains around the exact phishing page content because the site is no longer reachable and no screenshots or HTML snapshots have been published. No additional indicators such as malware payload hashes, command‑and‑control endpoints, or phishing email samples have been linked to this domain. Defenders should add 23.254.240.