sute-trezr[.]created[.]app

This domain, sute-trezr.created.app, was registered through Tucows Domains Inc. on July 12, 2023 and is currently listed as offline with an HTTP 404 response. The site resolves to the IP address 216.150.16.193, which belongs to AS16509 Amazon.com, Inc. and is geolocated in the United States. DNS resolution is provided by ns1.vercel-dns.com and ns2.vercel-dns.com, indicating deployment on the Vercel hosting platform. The SSL certificate is issued by Let’s Encrypt (R13), and the presence of HTTP Strict Transport Security (HSTS) further confirms a modern web stack. The page title observed in the limited capture reads "Official Trézor Suite — Desktop & Web App for Hardware Wallets," directly referencing the Trezor brand and matching the declared threat type of brand impersonation and crypto‑scam.

VirusTotal records show that 19 of the 95 scanned security vendors flagged the domain, and the domain appears on four independent blocklists: PhishDestroy, Polkadot, Enkrypt, and Codeesura. These detections collectively raise the risk assessment to high. No additional public intel such as OTX tags or Safe Browsing entries were supplied, leaving the broader campaign context uncertain. The combination of a legitimate‑looking brand reference, a recent registration date, and hosting on a widely used cloud provider suggests a low‑cost impersonation effort rather than a persistent infrastructure.

Defenders should update their URL filtering and blocklist feeds to include the exact hostname and its associated IP range. Endpoint protection solutions that integrate VirusTotal scores can benefit from the 19‑vendor detection count. Network defenders may consider blocking traffic to the Vercel DNS zones or flagging any TLS connections to the Let’s Encrypt certificate for this host. Continuous monitoring of the registrar (Tucows) for new domains that mimic Trezor terminology is advised, as the same template could be reused in future campaigns.