trezor[.]wallet[.]com[.]im

This domain, trezor.wallet.com.im, is under investigation as part of a suspected crypto drainer infrastructure targeting users of the Trezor hardware wallet. As of July 22, 2026, the domain remains active and resolves to the IP address 216.198.79.1. Infrastructure analysis reveals the use of nameservers associated with 1984.is and 1984hosting.com (ns0.1984.is, ns1.1984.is, ns1.1984hosting.com, ns2.1984hosting.com), which may indicate a hosting provider commonly utilized for such campaigns. The domain appears on one security blocklist and is currently blocked by PhishDestroy, though it has not been flagged by any of the 95 vendors that scanned it on VirusTotal as of the latest assessment.

The absence of detections does not confirm the domain's safety, particularly given its active status and association with crypto-related fraud. Defenders should note that the domain's structure (subdomain 'wallet' combined with 'trezor') strongly suggests an attempt to impersonate Trezor's legitimate services, likely to deceive users into interacting with malicious smart contracts or wallet-draining scripts. The specific content of the site has not been analyzed, so the exact mechanics of the drainer—such as whether it employs fake wallet interfaces, phishing forms, or direct transaction manipulation—remain unconfirmed. The domain's registration and hosting details do not provide additional context at this time, but the use of an Icelandic hosting provider (1984.is) may warrant further scrutiny of related infrastructure.

Organizations and individuals should treat this domain as high-risk until additional analysis is completed. Blocking access at the network level and monitoring for connections to 216.198.79.1 or the associated nameservers is recommended. Users should be cautioned against interacting with any wallet-related services hosted on this domain, and security teams should prioritize reviewing logs for attempted visits or referrals to trezor.wallet.com.im.