trzor[.]io

The domain trzor.io is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Trezor brand. Registration data shows the domain was created on 25 November 2023 through NameSilo, LLC, and it is hosted on the IP address 45.77.75.133, which resolves to a Vultr Holdings, LLC infrastructure in the United States. DNS resolution uses three authoritative nameservers (ns1.dnsowl.com, ns2.dnsowl.com, ns3.dnsowl.com). The site presents an HTTP 200 response and serves a TLS certificate issued by Let’s Encrypt (identifier YE1). The page title returned by the server is "SoftwaresProtect — Cloud System Protection," which does not reference the Trezor brand, indicating that the visible content has not been publicly verified beyond the title. VirusTotal analysis shows a single detection out of 91 security vendors, and the domain appears on one external blocklist, specifically PhishDestroy. No additional intelligence such as malware payloads, credential‑stealing forms, or redirection behavior is currently available. Defenders should treat trzor.io as a malicious indicator and block both the domain and its hosting IP at perimeter firewalls, DNS filters, and endpoint protection solutions. Continuous monitoring of the IP address and associated nameservers is advised, as the infrastructure could be reused for further impersonation attempts. Organizations using Trezor products should alert users to the existence of this domain and reinforce verification of official Trezor URLs.