trezor[.]com[.]im

Analysis of the domain trezor.com.im shows it was registered on 2026-06-08 and currently resolves to the IPv4 address 156.226.126.21, hosted in Hong Kong by CloudFly Net Inc. The site presents a valid TLS certificate issued by Let’s Encrypt (R12), and HTTP requests return status code 200. The page title returned by the server is a garbled string containing “Trezor” and Chinese characters, indicating an attempt to masquerade as the official Trezor brand. VirusTotal records indicate that 18 of 91 scanners flag the domain, and the domain appears in four AlienVault OTX pulses and three independent blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL, and receives a Gridinsoft trust score of 0 / 100, reinforcing its malicious classification as a high‑risk brand‑impersonation campaign targeting Trezor users. The evidence confirms active infrastructure but provides no additional details on the phishing page content or credential collection mechanisms. Defenders should add the domain and its resolving IP to blocklists, enforce TLS inspection, and monitor for related traffic, while threat‑intel teams may query the associated blocklists for indicators of compromise and investigate any observed connections to the HK host.