trezor-io[.]us-en[.]org

Analysis indicates that the domain trezor-io.us-en.org was registered on 21 February 2026 and is presently offline, returning a HTTP 403 Forbidden status. The site is listed on a single security blocklist and is actively blocked by PhishDestroy, confirming that it has been identified as a malicious resource. The domain is explicitly associated with brand impersonation of the hardware‑wallet provider Trezor, and its scam classification is recorded as a crypto‑scam. Infrastructure examination shows the domain resolves to IP 84.32.84.134, which belongs to Hostinger International Limited (AS47583) and is geolocated to Lithuania.

The SSL certificate is issued by ZeroSSL under the RSA Domain Secure Site CA, a free certificate authority often leveraged by malicious actors. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of legitimacy. VirusTotal analysis reports that one of ninety‑three scanning engines flagged the domain, reinforcing the suspicion of malicious intent despite the limited detection count.

The page title returned by the server is “403 Forbidden,” and no additional content was captured before the domain was taken offline. Defenders should continue to block the domain and its resolved IP address at perimeter and endpoint layers, add the host to internal threat‑intel feeds, and monitor for any future re‑registration or similar sub‑domains that mimic the Trezor brand. Ongoing observation of the hosting provider’s AS and any new certificates issued for related domains is recommended to pre‑empt re‑use of the same infrastructure.