trezosr[.]us

Analysis of trezosr.us, observed on July 23 2026, shows a domain created on 30 November 2025 and currently taken offline. The domain resolves to 104.21.31.169, an address owned by Cloudflare, Inc. (ASN 13335) located in the United States. No TLS certificate is presented, indicating that HTTPS is not enforced. The authoritative nameservers are aldo.ns.cloudflare.com and ximena.ns.cloudflare.com, both Cloudflare-managed. Registration was performed through CNOBIN INFORMATION TECHNOLOGY LIMITED, a registrar frequently associated with malicious infrastructure.

The site presented the page title “Trezor Suite Web” and is classified as a wallet/seed phishing campaign targeting the Apple brand. Reputation metrics indicate a Gridinsoft trust score of 0 out of 100, confirming an extremely low confidence in legitimacy. The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. AlienVault OTX lists the domain in two separate threat‑intel pulses, reinforcing its association with known malicious activity. VirusTotal scans returned 15 positive detections out of 95 security vendors, providing additional corroboration of malicious intent.

Defenders should block DNS resolution for trezosr.us, enforce URL filtering, and monitor for any outbound connections to 104.21.31.169. Because the domain uses Cloudflare’s infrastructure, the IP address may be shared with benign services; therefore, correlation with the specific domain name is essential before taking broader network actions. Continuous monitoring of the registrar CNOBIN INFORMATION TECHNOLOGY LIMITED for new registrations may reveal further campaigns. The absence of an SSL certificate and the offline status suggest that the phishing site may be short‑lived, but the observed indicators remain sufficient to justify proactive defensive measures.