trezapp[.]net

The domain trezapp.net has been identified as a brand impersonation threat specifically targeting Apple users. Analysis indicates the site masquerades as an official software distribution platform for Trezor Suite, a cryptocurrency wallet application, while falsely associating itself with Apple branding. The domain is currently offline, though its prior activity suggests a focus on credential theft or cryptocurrency drainer deployment under the guise of legitimate software distribution. Infrastructure analysis reveals the domain was registered on July 31, 2025, through NiceNIC International Group Co., Limited. It resolves to the IP address 172.67.143.148, located within the United States and associated with AS13335, a network operated by a major content delivery provider. The domain lacks an SSL certificate, increasing its risk profile for man-in-the-middle interception. Detection metrics show 17 of 95 security vendors on VirusTotal flagged trezapp.net as malicious, while it appears on a single blocklist maintained by independent security researchers. The page title, 'Trezor Suite Download - Official Software Distribution,' further corroborates the impersonation of both Apple and Trezor brands to lend credibility to the fraudulent operation. Current status indicates the domain has been taken offline, though its infrastructure remains a latent risk for re-emergence under similar tactics. Organizations and end-users are advised to implement proactive measures, including domain monitoring for re-registration or typosquatting variants, and integration of the identified IP and domain into network-level blocking policies. Users who may have interacted with the site should conduct immediate credential audits, particularly for accounts linked to cryptocurrency wallets or Apple services. Security teams are encouraged to review logs for connections to 172.67.143.148 and correlate with any anomalous authentication attempts or software download events.