trezor-giveaway[.]xyz

trezor-giveaway.xyz is an active domain observed on July 12, 2026 that mimics the legitimate Trezor brand by presenting a page titled “Trezor Suite”. The site hosts a full HTTP 200 response and supplies an SSL certificate issued to “Dis / trezor-giveaway.xyz”, suggesting an attempt to convey authenticity to unsuspecting users. The domain was registered on April 26, 2026 through Go Daddy, LLC and resolves to the IPv4 address 155.138.209.235, which is allocated to Vultr Holdings, LLC in the United States.

Infrastructure analysis shows the domain is served from a single host under the Vultr cloud provider, using the default Go Daddy nameservers ns21.domaincontrol.com and ns22.domaincontrol.com. The SSL certificate is self‑signed (Dis) and provides no chain of trust. No additional sub‑domains or associated IPs were identified in public records, limiting the visible attack surface to the single host.

Reputation data indicates a low trust score: Gridinsoft assigns a score of 0 out of 100, and VirusTotal reports that 2 of 95 scanned security vendors flagged the domain. The indicator appears in one AlienVault OTX pulse and is listed on three external blocklists, including PhishDestroy, MetaMask, and SEAL. These detections collectively confirm that the domain is being used for brand‑impersonation activity.

Defenders should block DNS resolution for trezor-giveaway.xyz and any sub‑domains, enforce TLS inspection to detect the untrusted certificate, and monitor outbound traffic to the IP 155.138.209.235. Email gateways should be configured to quarantine messages that contain links to this domain. Threat‑intel teams are advised to share the indicator with peers and update detection rules to include the observed page title and certificate subject.