trezor[.]fondacijasnd[.]rs

This domain, trezor.fondacijasnd.rs, is currently under investigation for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Registered on February 6, 2020, through TELEKOM SRBIJA A.D., the domain resolves to the IP address 198.18.7.145 and is hosted on infrastructure utilizing Plesk and Nginx technologies. Nameservers associated with the domain are dagda1.isp.telekom.rs and dagda2.isp.telekom.rs, indicating a connection to Telekom Serbia's hosting services. The page title, 'Национални тrezор културне баштине | National treasury of cultural heritage,' suggests an attempt to mimic a legitimate cultural or institutional site, though the exact content and functionality remain unconfirmed as no direct analysis of the webpage has been conducted. Infrastructure analysis reveals the domain is active, returning an HTTP 200 status, but lacks an SSL certificate, which is atypical for secure financial or cryptocurrency-related services. As of July 12, 2026, the domain appears on one security blocklist, specifically PhishDestroy, though it has not been flagged by any vendors in a recent scan. The absence of detections in such scans does not confirm the domain's safety, particularly given its association with a reported crypto scam. Defenders should note that the domain's registration predates the current investigation by over six years, which may complicate attribution but does not diminish its potential risk. Organizations monitoring for cryptocurrency-related threats should consider blocking or monitoring this domain, particularly if Trezor or similar wallet services are within their operational scope. The lack of SSL encryption and the mismatch between the page title and the purported brand target further justify heightened scrutiny. Additional analysis of the domain's content and network behavior is recommended to determine the full extent of its malicious activity.