trezorsuite[.]at

This domain, trezorsuite.at, is identified as a high-risk brand impersonation site designed to deceive users of the Trezor cryptocurrency wallet. The site mimics the official Trezor Suite application page, presenting itself as a legitimate download portal for wallet extensions. Analysis indicates the page title, 'The Trezor Suite App | Download Extension | Crypto & NFT Wallet,' is crafted to exploit trust in the Trezor brand, potentially leading users to download malicious software. Such impersonation attacks are commonly used to distribute crypto drainers or fake login portals, which can result in unauthorized access to digital assets and financial loss. Infrastructure analysis reveals multiple technical indicators confirming the malicious nature of this domain. The domain resolves to the IP address 193.108.113.211, located in Russia under AS48347 (JSC Mediasoft ekspert). It is registered through Gransy s.r.o., a registrar previously associated with suspicious domains. Detection metrics further support the threat assessment, with 23 out of 95 security vendors on VirusTotal flagging the domain as malicious. Additionally, the domain appears on five security blocklists, including PhishDestroy and PhishingDB, and is blocked by browser extensions such as Polkadot and Enkrypt. The SSL certificate, issued by Let's Encrypt, does not mitigate the risk, as it is commonly used by both legitimate and malicious sites. Users who have visited trezorsuite.at or interacted with its content should take immediate action to mitigate potential risks. Disconnect any devices that accessed the site from the internet and run a full security scan using updated antivirus software. If credentials or wallet information were entered, transfer assets to a new, secure wallet and revoke any connected session or authorization. Monitor accounts for unauthorized transactions and report the incident to relevant security teams or platforms. Given the domain's current offline status, users should remain vigilant for similar impersonation attempts targeting cryptocurrency services.