trezor-app[.]org

The domain trezor-app.org is assessed as a high-risk brand impersonation threat. It is actively impersonating the legitimate Trezor brand, which is known for secure cryptocurrency hardware wallets. This impersonation can lead to significant financial loss and compromise of sensitive user data.

Analysis indicates that trezor-app.org has been flagged by 16 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security experts regarding its malicious nature. The domain is registered through NameCheap, Inc., and resolves to the IP address 104.21.95.161. It was created on March 25, 2026, which is relatively recent, often indicative of a new and potentially active threat. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further corroborating its malicious intent. The SSL certificate is issued by Let's Encrypt, which is a common practice for malicious actors to gain user trust. The page title, 'Trezor App | Secure Your Crypto Assets,' closely mimics legitimate Trezor branding, making it particularly deceptive.

To mitigate the risks associated with this brand impersonation, users are advised to verify the domain's authenticity by comparing it with the official Trezor website and using verified security tools. Security teams should consider adding this domain to their blocklists and monitoring for any related malicious activity. Additionally, organizations should educate their users about the dangers of brand impersonation and encourage them to report any suspicious domains or activities.