suite-trezor[.]co[.]com

Analysis of the domain suite-trezor.co.com, recorded as offline on 23 July 2026, shows a clear brand‑impersonation campaign targeting users of the Trezor hardware wallet. The site presented the page title “Trezor Suite — Hardware Wallet for Safe Crypto Storage,” directly mirroring the official product name, which is consistent with the listed scam type of wallet/seed phishing. Infrastructure inspection reveals that the domain resolves to the IP address 158.94.208.115, which is registered to an Autonomous System (AS202412) operated by Omegatech LTD and geolocated to Germany. The hosting provider is further obscured by the use of the ddos‑guard.net nameservers (ns1 and ns2), a common tactic for evading takedown requests.

No TLS certificate was observed, indicating that the site was served over plain HTTP, which reduces trust signals for browsers and security products. The domain attained a Gridinsoft trust score of 0 out of 100, reflecting an extremely poor reputation. VirusTotal analysis flagged the domain in 14 of 95 security engines, confirming malicious classification by multiple vendors. Independent blocklist feeds have already added the domain to at least four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing the consensus that the site is being used for phishing.

Because the site is currently offline, live content cannot be examined, and details such as form fields or credential capture mechanisms remain unknown. Defenders are advised to continue to block the domain at network perimeter controls, update URL filtering rules with the observed blocklist entries, and monitor for any resurgence of the infrastructure, particularly the associated IP address and ddos‑guard nameservers. Threat intelligence teams should also correlate any reported Trezor seed or wallet compromise incidents with activity from this domain to aid attribution and victim notification.