suite-trezor[.]co[.]com
“Trezor Suite — Hardware Wallet for Safe Crypto Storage”
suite-trezor.co.com — Conteúdo indisponível (HTTP 502). Representação da marca: Trezor; Tipo de golpe: Wallet/seed Phishing. Resumo das evidências: VirusTotal 14/95 (ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar); URLQuery 100 det.; URLScan malicious verdict; Spamhaus DBL_PHISH; 3 external blocklist matches (Polkadot, Enkrypt, Codeesura); PhishDestroy score 95/100.
A análise detalhada do PhishDestroy AI permanece em inglês para preservar o registro forense original.
Analysis of the domain suite-trezor.co.com, recorded as offline on 23 July 2026, shows a clear brand‑impersonation campaign targeting users of the Trezor hardware wallet. The site presented the page title “Trezor Suite — Hardware Wallet for Safe Crypto Storage,” directly mirroring the official product name, which is consistent with the listed scam type of wallet/seed phishing. Infrastructure inspection reveals that the domain resolves to the IP address 158.94.208.115, which is registered to an Autonomous System (AS202412) operated by Omegatech LTD and geolocated to Germany. The hosting provider is further obscured by the use of the ddos‑guard.net nameservers (ns1 and ns2), a common tactic for evading takedown requests.
No TLS certificate was observed, indicating that the site was served over plain HTTP, which reduces trust signals for browsers and security products. The domain attained a Gridinsoft trust score of 0 out of 100, reflecting an extremely poor reputation. VirusTotal analysis flagged the domain in 14 of 95 security engines, confirming malicious classification by multiple vendors. Independent blocklist feeds have already added the domain to at least four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing the consensus that the site is being used for phishing.
Because the site is currently offline, live content cannot be examined, and details such as form fields or credential capture mechanisms remain unknown. Defenders are advised to continue to block the domain at network perimeter controls, update URL filtering rules with the observed blocklist entries, and monitor for any resurgence of the infrastructure, particularly the associated IP address and ddos‑guard nameservers. Threat intelligence teams should also correlate any reported Trezor seed or wallet compromise incidents with activity from this domain to aid attribution and victim notification.
Pipeline de resposta a ameaças
Status da lista de bloqueios pública
Análise do VirusTotal
Evidências e relatórios externos
“I recently lost my money due to fraudulent activities on certain websites. I kindly request you to ban all these sites to prevent others from falling victim to similar scams. Please take immediate action to protect users from potential financial losses.”
Você foi afetado por este site?
Se você inseriu credenciais de conta, informações pessoais ou de pagamento, ou baixou um arquivo deste domínio, tome medidas imediatas. Abaixo estão os recursos para ajudá-lo a relatar o incidente e se proteger.
Notifique as autoridades locais
Selecione seu país para obter contactos oficiais do cibercrime ou crie um rascunho de reclamação →.
Verificar qualquer domínio
Análise de ameaças usando lista de bloqueio armazenada, WHOIS, DNS e evidências de verificação pública
Digitalize agoraDenunciar phishing
Envie domínios suspeitos para nosso banco de dados de ameaças — proteja a comunidade
DenunciarFeed de ameaças em tempo real
Relatórios recentes de phishing e alterações de disponibilidade observadas
MonitorarMantenha-se informado, mantenha-se seguro
Monitore ameaças em tempo real ou conteste esta listagem caso acredite que se trate de um falso positivo