start-trezorsuite[.]us

Analysis date: 23 July 2026. The domain start-trezorsuite.us was registered on 21 February 2026 through ENOM, INC. The authoritative nameservers ns61.hostwindsdns.com and ns62.hostwindsdns.com resolve the domain to the IPv4 address 23.254.240.243, which belongs to AS54290 Hostwinds LLC located in the United States. No TLS certificate is presented, indicating the site is served only over HTTP. The page title returned by the server reads “Trezor Suite – Download Trezor Suite Wallet App – Trezor Suite”, explicitly referencing the Trezor brand and suggesting a cryptocurrency‑wallet download.

VirusTotal records show that 12 of 93 scanned security vendors flagged the domain, and the domain currently appears on three public blocklists. Additional reputation services have assigned a Gridinsoft trust score of 0 / 100, and the domain is listed as blocked by PhishDestroy, MetaMask, and SEAL. The campaign is categorized as a crypto‑scam employing brand impersonation of Trezor. No additional page content has been captured, so the exact malicious payload remains unverified.

As of the report date the site is offline, but the infrastructure components—registrar, hosting provider, and nameservers—remain active and could be reused for future malicious deployments. Defensive recommendations include adding the IP address 23.254.240.243 and the domain start-trezorsuite.us to outbound and inbound filtering rules, monitoring for similar Trezor‑related brand‑impersonation patterns, and ensuring that endpoint security solutions reference the current blocklist entries. Organizations that manage cryptocurrency assets should educate users about the absence of a valid SSL certificate and verify official download sources directly from the Trezor website. Continuous threat‑intelligence feeds should be consulted for any re‑appearance of this infrastructure.