portfolio-trezor[.]io

This domain, portfolio-trezor.io, was observed delivering a wallet‑seed phishing campaign that impersonates the Trezor brand. The site was registered on 25 October 2025 through Gname.com Pte. Ltd. and resolves to the IPv4 address 178.16.54.185, which is hosted in the Netherlands under ASN 202412 owned by Omegatech LTD. The authoritative nameservers are a.share-dns.com, a5.share-dns.com, b.share-dns.net and b5.share-dns.net. No TLS certificate was presented, indicating the site was served over plain HTTP. The HTML title returned by the server is “Trezor Suite”, matching the advertised brand and supporting the classification as a wallet/seed phishing vector.

Threat intelligence corroborates the malicious intent: the domain appears in sixteen AlienVault OTX pulses and has been listed on one public security blocklist. PhishDestroy has taken the domain offline, and the current status is reported as taken offline. VirusTotal scans show fifteen of ninety‑five security vendors flagging the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the high confidence of compromise. Defenders should block traffic to 178.16.54.185 and to the domain name itself at perimeter firewalls and DNS filters.

Because the site lacks HTTPS, any attempt to retrieve content will be unencrypted, which may be useful for network‑level detection. Monitoring for newly created domains that resolve to the same nameserver set or that use the same registrar (Gname.com Pte. Ltd.) can help identify future replicas. Incident responders should also update URL blocklists with the exact domain and consider adding the associated IP to threat‑intel feeds. As the site is currently offline, remediation focus should remain on preventing re‑use of the infrastructure and on educating users about unsolicited requests for seed phrases that reference “Trezor Suite”.