trezorsecure[.]support

The domain trezorsecure.support has been identified as a brand‑impersonation site targeting users of the Trezor hardware wallet. Infrastructure analysis shows the domain is delegated to the DNS Owl name servers (ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com) and resolves to the Cloudflare address 172.66.134.245, an IP located in the United States and associated with AS13335 Cloudflare, Inc. No TLS certificate is presented, meaning HTTPS connections are not available and any traffic is forced over HTTP, a characteristic often observed in malicious deployments. VirusTotal reports that one of ninety‑five scanning engines flagged the domain, indicating at least one detection of malicious behavior.

Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the site’s legitimacy. The page title returned by the web server reads “Trezor Hardware Wallet (Official) | Bitcoin & Crypto Security,” directly copying the brand’s official phrasing and reinforcing the impersonation claim. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming that external threat‑intel feeds consider it hostile.

The overall risk assessment is elevated, driven by the combination of brand spoofing, low trust metrics, lack of encryption, and confirmed detection by security vendors. Defenders should update web‑filtering and DNS‑sinkhole rules to block trezorsecure.support, monitor outbound traffic for connections to the associated Cloudflare IP, and educate end‑users that any Trezor‑related communications should only occur over verified, TLS‑protected domains owned by SatoshiLabs. Because the site is currently taken offline, continued observation of its DNS records and any re‑hosting attempts is advised to pre‑empt a potential resurgence.