welcom-suite-trezo[.]netlify[.]app

This domain, welcom-suite-trezo.netlify.app, was identified as a high-risk brand impersonation site targeting Trezor, a cryptocurrency hardware wallet provider. Registered on June 29, 2026, through Netlify, the domain resolved to an IPv6 address (2a05:d014:58f:6200::259) hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. The page title, 'Trezor Suite - Secure Cryptocurrency Management,' directly mirrors Trezor's legitimate branding, indicating an intent to deceive users into believing the site is an official Trezor platform. No nameservers were detected at the time of analysis, and the domain returned an HTTP 404 status, suggesting it may have been taken offline or moved post-compromise.

Analysis reveals the domain was flagged by 10 of 91 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the risk, as phishing domains frequently use valid certificates to appear legitimate. Technologies detected include Netlify hosting and HSTS enforcement, which may have been leveraged to evade initial scrutiny.

Defenders should treat this domain as confirmed malicious. Block access at the DNS and network levels, and monitor for related infrastructure, particularly Netlify-hosted subdomains with similar naming patterns (e.g., 'suite-trezo,' 'trezor-wallet'). Given the domain's offline status, further forensic analysis may be limited, but historical DNS and certificate transparency logs could reveal additional indicators. No evidence links this domain to a specific phishing kit or broader campaign, though its impersonation of Trezor aligns with common cryptocurrency theft tactics.