web-trezorsuite[.]com

Analysis of web-trezorsuite.com shows a domain created on February 21, 2026 that is currently taken offline but was previously used to impersonate Instagram. The site resolved to IP address 91.212.166.22, which geolocates to Russia, and the SSL certificate received an R10 trust rating, indicating a low‑trust certificate often associated with malicious infrastructure. The page title returned by the server was "Avila Bikes | Taller de Reparacion de Bicicletas y Patinetes," a content mismatch that suggests the domain was leveraged for a phishing campaign rather than a legitimate bicycle service.

Detection data shows the domain was listed on a single security blocklist, PhishDestroy, and 7 of 93 VirusTotal scanners flagged it as malicious, providing independent corroboration of its abusive nature. No additional evidence such as Safe Browsing, OTX, or registrar details were supplied, and the HTTP status after takedown is not reported.

Given the confirmed brand impersonation of Instagram and the observed hosting characteristics, defenders should proactively block traffic to 91.212.166.22, add web-trezorsuite.com to internal deny lists, and monitor the IP range for re‑use. Continuous observation of threat‑intel feeds for re‑registration of the domain or similar Russian‑hosted infrastructure is advised to mitigate potential resurgence of the phishing campaign.