trezor[.]one

This domain, trezor.one, is actively flagged as a high-risk brand impersonation threat targeting Trezor, a well-known hardware wallet provider. Infrastructure analysis reveals the domain was registered on November 4, 2018, through Name.com, Inc., and currently resolves to the IP address 172.66.134.245. The page title, 'Trezor Hardware Wallet (Official) | Bitcoin & Crypto Security,' explicitly mimics the branding of the legitimate Trezor site, indicating an intent to deceive users into believing the site is authentic. Multiple threat intelligence sources corroborate this assessment: the domain appears in 23 AlienVault OTX pulses, is blocked by PhishDestroy and BLP-Malware, and is listed on two security blocklists. Gridinsoft assigns a trust score of 0/100, further supporting the malicious classification. While two of 95 security vendors on VirusTotal flag the domain, the absence of broader detection does not diminish the confirmed indicators of compromise. The domain remains operational as of July 12, 2026, posing an ongoing risk to users seeking cryptocurrency security solutions. Defenders should prioritize blocking this domain at the DNS and network levels, and security teams should monitor for related infrastructure, such as associated IP ranges or newly registered lookalike domains. The exact content and functionality of the site have not been analyzed, but the combination of brand impersonation, low trust scores, and active blocklist presence provides sufficient evidence to treat this as a confirmed threat.