trezorsuite[.]web3apps[.]biz

This domain trezorsuite.web3apps.biz is currently offline but exhibits multiple indicators of a malicious brand‑impersonation campaign targeting Trezor users. The registration record shows the domain was created on 14 October 2025 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 172.67.152.158, which belongs to AS13335 Cloudflare, Inc. in the United States. Cloudflare hosting is common for both legitimate services and abuse; the lack of an SSL certificate further reduces the credibility of the site.

The Gridinsoft trust score is 0 out of 100, and the domain appears on one security blocklist, confirming that at least one external feed has already flagged it. VirusTotal analysis shows that six of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious activity. PhishDestroy has also blocked the domain, indicating that it has been identified as part of a phishing or scam infrastructure. The domain is classified as a “Crypto Scam” and explicitly impersonates the hardware‑wallet brand Trezor.

No additional metadata such as page titles or content snapshots are available, so the exact visual presentation cannot be confirmed. Defenders should ensure that DNS filtering solutions block trezorsuite.web3apps.biz, add the IP 172.67.152.158 to any relevant deny lists, and monitor for any future re‑hosting attempts. Because the domain is hosted on Cloudflare, it may be able to switch origin servers quickly; continuous re‑evaluation of the IP and associated certificate status is advised. Logging any outbound connections to this domain and correlating with user activity logs can help identify compromised endpoints that may have attempted to access the site before it was taken offline.