trezor-en[.]live

The domain trezor-en.live has been identified as a brand impersonation threat specifically targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates this domain was designed to mimic the official Trezor platform, likely to facilitate credential harvesting or cryptocurrency theft. The site is currently offline, though prior activity suggests it operated as a fake login portal under the guise of "TREZOR - Crypto Security Redefined." Infrastructure analysis reveals the domain was registered on February 06, 2026, through Name.com, Inc., a registrar frequently associated with malicious domains. It resolved to the IP address 34.111.179.208, hosted on Google LLC’s AS396982 network in the United States. The domain appears on three security blocklists and is flagged by 23 of 95 VirusTotal security vendors, including PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Let’s Encrypt (serial number E7), a common choice for both legitimate and malicious sites due to its free and automated issuance process. Current status indicates the domain has been taken offline, though its prior infrastructure and detection metrics confirm high-risk classification. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations are advised to block the domain and associated IP at the network level, while security teams should treat any residual connections as indicators of compromise. Given the domain’s creation date discrepancy (2026), this may also serve as a red flag for temporal anomalies in future threat hunting efforts.