suite[.]eng-trezor[.]io

The domain suite.eng-trezor.io was registered on August 20 2025 through Hosting Concepts B.V. operating as Registrar.eu. DNS resolution points to the IPv4 address 45.82.82.240, which is announced by AS9123 JSC TIMEWEB and geolocated to Russia. The authoritative name servers are a.dnspod.com and c.dnspod.com, and the site does not present an SSL/TLS certificate, leaving traffic unencrypted. The HTTP response returns a page whose title is “Trezor Suite”, directly matching the brand target Trezor and indicating an attempt to masquerade as the official wallet interface.

Classification from the intelligence set lists the scam type as wallet/seed phishing, consistent with the brand impersonation. The domain appears on a single security blocklist and has been added to the PhishDestroy blocklist. A Gridinsoft trust score of 0 out of 100 further reflects its malicious nature. VirusTotal analysis shows that 12 of 95 scanning engines flagged the domain as malicious, reinforcing the suspicion.

The domain is currently marked as taken offline, which may be the result of takedown actions or hosting changes. Defenders should continue to block the IP address 45.82.82.240 and the domain suite.eng-trezor.io at DNS and proxy layers, monitor the associated name servers for any re‑registration, and enforce strict TLS inspection policies to detect any future unencrypted credential exfiltration attempts. Additional verification of any URLs that resolve to the same IP should be performed, as the infrastructure could be reused for similar wallet‑phishing campaigns. At present, no further technical artifacts such as payload samples or malicious scripts have been publicly disclosed, so investigators should prioritize collection of network traffic if the domain reappears.