trezor[.]io-app-web-suite[.]com

Analysis of trezor.io-app-web-suite.com shows a high‑risk brand‑impersonation infrastructure targeting Trezor users. The domain was registered on July 11 2025 through Tucows Domains Inc. and resolves to the Cloudflare address 188.114.96.3 (AS13335, United States). DNS is served by brett.ns.cloudflare.com and norah.ns.cloudflare.com. No TLS certificate is presented, and the site returns HTTP 200, indicating the content is reachable without encryption.

The page title observed is "Bot Verification," a common tactic used to evade automated scanning and to force human interaction. The hosting appears to be part of a known Airdrop Scam phishing kit, classified as a crypto‑scam. VirusTotal scans flagged the domain by six of ninety‑five AV engines, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

While the exact payload or credential‑capture pages have not been publicly disclosed, the combination of brand impersonation, lack of SSL, low trust score, and detection by multiple security vendors indicates a purposeful attempt to deceive Trezor users. Defenders should block the domain at perimeter firewalls, update URL filtering feeds, monitor DNS queries for the domain and its nameservers, and educate users that any unsolicited Trezor‑related requests originating from this domain are fraudulent. Continuous monitoring of the IP address and associated Cloudflare accounts is advised, as the infrastructure may be leveraged for additional crypto‑related scams.