trezors[.]com[.]cn

Analysis of trezors.com.cn indicates an active brand impersonation campaign targeting Trezor, a hardware cryptocurrency wallet provider. The domain, registered on April 29, 2026, through a Chinese registrar, resolves to IP address 156.226.126.17 and uses a Let's Encrypt SSL certificate. The page title, encoded in UTF-8, explicitly references Trezor's official branding and services, including 'secure open-source hardware wallet,' 'Bitcoin,' and 'cryptocurrency offline storage,' which aligns with known Trezor marketing terminology. Security vendors have flagged this domain as malicious, with 24 out of 95 engines on VirusTotal detecting it. The domain appears in 16 threat intelligence pulses on AlienVault OTX and is blocked by at least four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware. Gridinsoft assigns a trust score of 0/100, further indicating high risk. No evidence currently suggests the use of a known phishing kit or specific malware family, and the exact content of the site remains unanalyzed beyond the page title. Defenders should treat this domain as a confirmed phishing threat targeting cryptocurrency users. Recommended actions include blocking the domain and its resolving IP at the network level, updating endpoint protection rules to flag any connections, and monitoring for credential submissions or wallet interactions associated with this infrastructure. Given the domain's registration in April 2026 and continued activity as of July 2026, it is likely part of an ongoing campaign rather than a short-lived operation.