Trezor

Crypto & web3 Czechiatrezor.ioRank 44 of the most impersonated
Cert findings · 24 h
13
Cert findings · 7 days
196
122 reported or listed · 56 on phishing hosts · 18 on Spamhaus DROP
Registered lookalikes
180
27 listed by a source or an address list
Official domains
2
verified from Trezor's own sites and records

Certificate findings for Trezor

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Trezor's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 290 findings, grouped by hostname

  1. official-trezor.com GB · AS197574 · EXPRESSHOST ExpressHost Ltd3 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    official-trezor.com
    First seen
    2026-11-05 09:04 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.115.
    1. Phishing-host list fetched with the address
    2. Resolved to 154.86.119.115
    Brand
    Trezor
    Addresses
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    31.59.175.142 · Hong Kong · AS56971 AS56971 CGI GLOBAL LIMITED
    154.86.119.151 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    Domain
    official-trezor.com
    Registered
    2026-10-26 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:27 UTC

    Suggest a correction

  2. www.official-trezor.com GB · AS197574 · EXPRESSHOST ExpressHost Ltd2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    www.official-trezor.com
    First seen
    2026-11-05 09:01 UTC
    DNS
    Resolves · checked 2026-11-05 09:01 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.115.
    1. Phishing-host list fetched with the address
    2. Resolved to 154.86.119.115
    Brand
    Trezor
    Addresses
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    31.59.175.142 · Hong Kong · AS56971 AS56971 CGI GLOBAL LIMITED
    Domain
    official-trezor.com
    Registered
    2026-10-26 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:27 UTC

    Suggest a correction

  3. wildcard.wildcard.secure-bridge-trezor.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    wildcard.wildcard.secure-bridge-trezor.wasmer.app
    First seen
    2026-11-05 07:56 UTC
    First published
    2026-11-05 08:42 UTC
    DNS
    Resolves · checked 2026-11-05 08:45 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 06:53 UTC to 2027-02-03 06:53 UTC
    Logged 2026-11-05 07:51 UTC in Google ParcelYard2027h1, entry 622,140,159
    SHA-256 63ea14f049421b1f80f7b99e2901581a991a2f4b4c540557430dfc51c5353aca
    Public key SHA-256 e519f4cbb6f1b3fd1ef5c3c466ee1773f37d09ff8e55e1e19cf0a67e989a292e
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  4. trezor-suites-qw.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-suites-qw.pages.dev
    First seen
    2026-11-04 20:21 UTC
    First published
    2026-11-04 21:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 21:16 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-02-02 14:00 UTC
    Logged 2026-11-04 20:16 UTC in Geomys Tuscolo2027h1, entry 477,341,054
    SHA-256 b626d5075a501846103a1d4b6b985b998793c7841f57d16db74a7a26549f990a
    Public key SHA-256 cf8bf564f8c34718d57b0c5bcde4d390afd33714676b0e7c765e3b67258e2e8a
    Brand
    Trezor
    Addresses
    172.66.44.162 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.94 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2ca2
    2606:4700:310c::ac42:2f5e
    Cloudflare
    Cloudflare (172.66.44.162, 172.66.47.94): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  5. web-suites-trezor.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    web-suites-trezor.pages.dev
    First seen
    2026-11-04 19:46 UTC
    First published
    2026-11-04 20:01 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 20:05 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 18:45 UTC to 2027-02-02 19:43 UTC
    Logged 2026-11-04 19:45 UTC in Google ParcelYard2027h1, entry 613,639,201
    SHA-256 7dc3848d767544477c2ccca400823ffb2db1a210b1f02068761b88b7a5a28af6
    Public key SHA-256 d3335b525384d4062a4e33d9fcc9fc26d874b606558ad32a95ea9cca552b44e8
    Brand
    Trezor
    Addresses
    172.66.44.101 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.155 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c65
    2606:4700:310c::ac42:2f9b
    Cloudflare
    Cloudflare (172.66.44.101, 172.66.47.155): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  6. www.trezor-eng.org GB · AS197574 · EXPRESSHOST ExpressHost Ltd2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 5 d ago
    DetailsHide
    Hostname
    www.trezor-eng.org
    First seen
    2026-11-04 19:10 UTC
    First published
    2026-10-31 19:03 UTC
    DNS
    Resolves · checked 2026-11-04 19:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 154.86.119.115.
    1. Phishing-host list fetched with the address
    2. Resolved to 154.86.119.115
    Brand
    Trezor
    Addresses
    154.86.119.115 · United Kingdom · AS197574 EXPRESSHOST ExpressHost Ltd
    46.8.102.227 · United Arab Emirates · AS211273 csoft Cloud Software - FZCO
    Domain
    trezor-eng.org
    Registered
    2026-10-31 · Key-Systems GmbH
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:19 UTC

    Suggest a correction

  7. trezor-login-faq-help.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-login-faq-help.wasmer.app
    First seen
    2026-11-04 18:36 UTC
    First published
    2026-11-04 18:52 UTC
    DNS
    Resolves · checked 2026-11-04 18:54 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 17:35 UTC to 2027-02-02 17:35 UTC
    Logged 2026-11-04 18:34 UTC in Google ParcelYard2027h1, entry 612,794,775
    SHA-256 0885ac68249a55fd10eacff584405af085c0048346fcd510cc87fc75ad3eb408
    Public key SHA-256 ef4c1f18aca6abd74047acfb5bfdf85bae0fac51301402c01be58180fd57791a
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  8. wildcard.wildcard.trezor-bridge-hub.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    wildcard.wildcard.trezor-bridge-hub.wasmer.app
    First seen
    2026-11-04 17:52 UTC
    First published
    2026-11-04 18:05 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 16:48 UTC to 2027-02-02 16:48 UTC
    Logged 2026-11-04 17:46 UTC in Google ParcelYard2027h1, entry 612,202,382
    SHA-256 c25ca11c00a179abdd10a905554960116b8bc274b9ad53c7c0f8fbc3204a0e0f
    Public key SHA-256 ddcbc94d634dca4ee8470045d8ea7c063bb66f03c5392a712df68ba99bb90f34
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  9. checker-trezor.io US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    checker-trezor.io
    First seen
    2026-11-04 17:26 UTC
    First published
    2026-11-04 18:05 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:17 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-04 00:00 UTC to 2027-02-01 04:41 UTC
    Logged 2026-11-04 17:21 UTC in Let's Encrypt Sycamore2027h1, entry 944,676,346
    SHA-256 2cd46a7f009b2c85c9daea0b8b4f1fc8e9876a0c51de63abd7ba03308aafcde9
    Public key SHA-256 2ba81c8222fe9efe3c41efd9c293ddc9aa92cd8833d02fc6d578f86595033d42
    Brand
    Trezor
    Addresses
    104.21.18.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.183.78 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:b74e
    2606:4700:3035::6815:12c5
    Cloudflare
    Cloudflare (104.21.18.197, 172.67.183.78): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    checker-trezor.io
    Registered
    2026-08-17 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:05 UTC

    Suggest a correction

  10. trezor-io-start-fra.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-start-fra.wasmer.app
    First seen
    2026-11-04 10:26 UTC
    First published
    2026-11-04 10:38 UTC
    DNS
    Resolves · checked 2026-11-05 10:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 09:24 UTC to 2027-02-02 09:24 UTC
    Logged 2026-11-04 10:23 UTC in Google PlumbersArms2027h1, entry 607,079,932
    SHA-256 87f45af185adc4d85b7470056f27aa46a2ce6c4f75e0ec9b557f8f4b93e550ad
    Public key SHA-256 784d8332126d33abb7c7166cf5f6c39ca9e59c0582f8a934bcdaea76ccc2ba56
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  11. 338592-trezor.io US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    338592-trezor.io
    First seen
    2026-11-04 09:46 UTC
    First published
    2026-11-04 10:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 10:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 08:46 UTC to 2027-02-02 08:46 UTC
    Logged 2026-11-04 09:44 UTC in Let's Encrypt Sycamore2027h1, entry 938,694,440
    SHA-256 bcee57a0b5696fcbd84f7e0801c3bf07eeb7de1f0ccc4849372ec31ea29699db
    Public key SHA-256 1432eadbd9a8222ffdb0fcd9cbe33dff701753c022022d656eb40654e8eee3a4
    Brand
    Trezor
    Addresses
    104.21.2.38 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.128.174 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::ac43:80ae
    2606:4700:3035::6815:226
    Cloudflare
    Cloudflare (104.21.2.38, 172.67.128.174): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    338592-trezor.io
    Registered
    2026-05-11 · Atak Domain Bilgi Teknolojileri A.Ş.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:50 UTC

    Suggest a correction

  12. www.trezorgroup.com PL · AS43641 · Sollutium-NL SOLLUTIUM EU S…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    www.trezorgroup.com
    First seen
    2026-11-04 09:06 UTC
    DNS
    Resolves · checked 2026-11-05 09:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.134.174.57.
    1. Phishing-host list fetched with the address
    2. Resolved to 45.134.174.57
    3. Latest DNS check
    Brand
    Trezor
    Addresses
    45.134.174.57 · Poland · AS43641 Sollutium-NL SOLLUTIUM EU Sp z.o.o.
    Domain
    trezorgroup.com
    Registered
    2026-05-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  13. trezorgroup.com PL · AS43641 · Sollutium-NL SOLLUTIUM EU S…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    trezorgroup.com
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.134.174.57.
    1. Phishing-host list fetched with the address
    2. Resolved to 45.134.174.57
    3. Latest DNS check
    Brand
    Trezor
    Addresses
    45.134.174.57 · Poland · AS43641 Sollutium-NL SOLLUTIUM EU Sp z.o.o.
    Domain
    trezorgroup.com
    Registered
    2026-05-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  14. secure.trezorgroup.com PL · AS43641 · Sollutium-NL SOLLUTIUM EU S…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC policy noneRegistered 6 mo ago
    DetailsHide
    Hostname
    secure.trezorgroup.com
    First seen
    2026-11-04 08:58 UTC
    DNS
    Resolves · checked 2026-11-05 08:59 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.134.174.57.
    1. Phishing-host list fetched with the address
    2. Resolved to 45.134.174.57
    3. Latest DNS check
    Brand
    Trezor
    Addresses
    45.134.174.57 · Poland · AS43641 Sollutium-NL SOLLUTIUM EU Sp z.o.o.
    91.234.199.6 · Poland · AS43641 Sollutium-NL SOLLUTIUM EU Sp z.o.o.
    Domain
    trezorgroup.com
    Registered
    2026-05-20 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 08:30 UTC

    Suggest a correction

  15. trezor-llogin.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-llogin.pages.dev
    First seen
    2026-11-04 08:51 UTC
    First published
    2026-11-04 09:19 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:38 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-04 07:47 UTC to 2027-02-02 08:45 UTC
    Logged 2026-11-04 08:47 UTC in DigiCert Sphinx2027h1, entry 352,927,992
    SHA-256 a3ff5e3c2c61d4062b1a516483a9686972f9fc2e65a928dd98c41253e7eb945e
    Public key SHA-256 3d1b88e8f1b4f4ca0dea3cc7ec68b302cea7cd4fc39c160f10de58185805d85e
    Brand
    Trezor
    Addresses
    172.66.44.148 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.108 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c94
    2606:4700:310c::ac42:2f6c
    Cloudflare
    Cloudflare (172.66.44.148, 172.66.47.108): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  16. trezor-io-crypto-setup.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-crypto-setup.wasmer.app
    First seen
    2026-11-04 07:36 UTC
    First published
    2026-11-04 08:03 UTC
    DNS
    Resolves · checked 2026-11-05 08:17 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 06:32 UTC to 2027-02-02 06:32 UTC
    Logged 2026-11-04 07:30 UTC in Geomys Tuscolo2027h1, entry 470,097,574
    SHA-256 28bdef8bd26a1f8246c14ecf90bab870da32910cfdb47af7e22be2b3279932cf
    Public key SHA-256 9eebdd5ca0f98f0d381cd95deb05dc3bdc0fefc08e850ce53d11b807eee84189
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  17. trezor-suittd.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-suittd.pages.dev
    First seen
    2026-11-04 05:00 UTC
    First published
    2026-11-04 05:23 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-02-01 02:46 UTC
    Logged 2026-11-04 04:57 UTC in IPng Networks Halloumi2027h1, entry 357,197,822
    SHA-256 1031d3413dd6f61a8855e51779a83d693c524a88ce1c871db5aa52d53ba99aac
    Public key SHA-256 87346bc73cf398ddd573dc307fe6de24624cc0744b892d32ca520835eef58327
    Brand
    Trezor
    Addresses
    172.66.44.214 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.42 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cd6
    2606:4700:310c::ac42:2f2a
    Cloudflare
    Cloudflare (172.66.44.214, 172.66.47.42): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  18. 245551-trezor.io US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 14 d ago
    DetailsHide
    Hostname
    245551-trezor.io
    First seen
    2026-11-04 04:31 UTC
    First published
    2026-11-04 05:23 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:28 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-04 00:00 UTC to 2027-01-29 16:26 UTC
    Logged 2026-11-04 04:27 UTC in Let's Encrypt Willow2027h1, entry 925,992,400
    SHA-256 c656f2a6a5c9d71d69bc0d3f1b1e52c2ae02d0d3141d08d0622f78418b09fd18
    Public key SHA-256 3562d982ac354134f4eced9dcdda4d54ba69060e4120e520a884adfd250004ea
    Brand
    Trezor
    Addresses
    104.21.69.95 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.206.247 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:cef7
    2606:4700:3036::6815:455f
    Cloudflare
    Cloudflare (104.21.69.95, 172.67.206.247): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    245551-trezor.io
    Registered
    2026-10-22 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 04:37 UTC

    Suggest a correction

  19. trezor-cardano-mainnet.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    trezor-cardano-mainnet.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:58 UTC in Google ParcelYard2027h1, entry 601,123,605
    SHA-256 5cfda08915f4f8273da426c0a5cf2eb5b5d973bd6dc53be8d95d3074c8e4522a
    Public key SHA-256 cd18a9290263c774f6115dbc37b1ec458f60687ae11b0137eb80d96602fa9418
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  20. sol3.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    sol3.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in IPng Networks Gouda2027h1, entry 309,578,398
    SHA-256 04037acafc632a675b29635764ed34f04f41e85da9519bf31b091845efac3a21
    Public key SHA-256 d0b5a6e8eea4bde0f1a447c26b1f17808598188b07d4d8b77af1e96d92888a88
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  21. sepolia1.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    sepolia1.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 01:58 UTC to 2027-02-02 01:58 UTC
    Logged 2026-11-04 02:57 UTC in IPng Networks Gouda2027h1, entry 309,572,625
    SHA-256 54691ee4513db03082e2369f3e8972c37730fe547879b7b54b588340fc81f507
    Public key SHA-256 55c5dd86c36d7f8bbed2554a6fc5b6449f3a9b858b86e1a353dcc4b7455b02c6
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  22. pol2.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    pol2.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in IPng Networks Halloumi2027h1, entry 356,142,521
    SHA-256 e5b93a073875c414b807e783d9038a116697901918f7f6a577f19cca50e1e719
    Public key SHA-256 69307690f01d72d82414cce8df859c1037ecd83c5052c4e6d62a644c37955648
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  23. op4.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    op4.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in DigiCert Wyvern2027h1, entry 396,814,520
    SHA-256 57a8de3b7ef152cf88467cf536caee1ab64abda10ecfbbe75e0a7f877fc6d368
    Public key SHA-256 574a0b756825c280ba959d15d946bd6a1b8b7461c73659cd9fc68011e326d36f
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  24. horizon.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    horizon.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:58 UTC in Google PlumbersArms2027h1, entry 601,560,695
    SHA-256 90602112d795a2700bfc48671b4fb7945448304a954295e58ceaacde87bcf5e4
    Public key SHA-256 8ad1e4ee830c074d2ec64f7842bf4899afc5dbf575f20e87902a8aa8b829caec
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  25. eth-api-b2c.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    eth-api-b2c.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:58 UTC in Google ParcelYard2027h1, entry 601,124,343
    SHA-256 a32fb65413c4569004d5094ac2b985f474d60c67bc4f4ec3dac0cdf9891ba4e4
    Public key SHA-256 9d551f9cb7dd3e00512b3d1f23c9a13fdea024f70106e53de5169ae9d5fb77dd
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  26. eth4.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    eth4.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:58 UTC to 2027-02-02 01:58 UTC
    Logged 2026-11-04 02:57 UTC in DigiCert Wyvern2027h1, entry 396,811,799
    SHA-256 2195e58c7e9f2f08224b7410121ead242413ddefad4f60ed7c64151c17023978
    Public key SHA-256 b555c2cc7116ef3d18140f39e604783e99ab32af719e1b8f5b00eb1ab63a2d13
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  27. etc1.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    etc1.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in Let's Encrypt Willow2027h1, entry 924,819,580
    SHA-256 7c3c493fe8ee3952464cd0263147335327a3f825331cee67785f9b379adbf136
    Public key SHA-256 6e1904d09073256b0e0685168843da26c688c94d26cbee1747d5effb69ea12bd
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  28. btc3.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    btc3.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 01:58 UTC to 2027-02-02 01:58 UTC
    Logged 2026-11-04 02:57 UTC in Let's Encrypt Willow2027h1, entry 924,810,244
    SHA-256 ad48c4dcaaa1d89027e0624584c678c579ab9417e422f8a35447ccb2177187fb
    Public key SHA-256 e2b8a5c6a7f3e3da2a308ed563aa7bb67058a381939412bf601a2a9ed802a130
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  29. btc1.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    btc1.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 01:58 UTC to 2027-02-02 01:58 UTC
    Logged 2026-11-04 02:57 UTC in Google ParcelYard2027h1, entry 601,110,519
    SHA-256 22d67ec8e1d982df81340f81b5c692cc36116cf6bd609fbb6e0bca2a42434ef0
    Public key SHA-256 e54fb51d938fd810ec8136f8b22290624dc5bf0cbc211dc92371bc5171ae7e29
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  30. bsc3.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    bsc3.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in Let's Encrypt Sycamore2027h1, entry 933,367,971
    SHA-256 8db31c20a800de7172ec232dd0a1f346ce3026c5063e0d586bc24257b04ed357
    Public key SHA-256 e2b805a6e2851cf56465767d0a63954e2e72818329b8d194a6d97d9c2dbbf230
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  31. base4.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    base4.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 01:58 UTC to 2027-02-02 01:58 UTC
    Logged 2026-11-04 02:57 UTC in DigiCert Sphinx2027h1, entry 349,813,155
    SHA-256 9732b201be3dc5b9a5d29fc49bb6be7cbf2f9421cdd9da1d590c439c09f6b88e
    Public key SHA-256 9e619972f9cfaaf1281e729b91891020495463dfc664ea0b66863397d4120b24
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  32. arb2.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    arb2.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in DigiCert Wyvern2027h1, entry 396,815,282
    SHA-256 02db9cbf2a073ef5d10be1ba6943f61207aa21dccb77d246ba9063dcdb991de0
    Public key SHA-256 5497fe52ea37e8400ef9f14e0a416e47f325d7d9cb3485b6355b1331684c962c
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  33. ada2.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    ada2.trezor.im
    First seen
    2026-11-04 03:01 UTC
    First published
    2026-11-04 04:15 UTC
    DNS
    Resolves · checked 2026-11-05 04:28 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 01:59 UTC to 2027-02-02 01:59 UTC
    Logged 2026-11-04 02:57 UTC in Let's Encrypt Willow2027h1, entry 924,820,921
    SHA-256 3ff56ecc688e077a9faefea8609689a8cbd854b2472d7f09a74b2d165dd66bf3
    Public key SHA-256 a6f3c5680eb565565c4e9c7469fcd03f89dcc27823d04ef5cacd7b8996afc7f0
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  34. suite.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    suite.trezor.im
    First seen
    2026-11-04 02:42 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:39 UTC to 2027-02-02 01:39 UTC
    Logged 2026-11-04 02:37 UTC in Google PlumbersArms2027h1, entry 601,335,095
    SHA-256 5fc3da824b412479b07153fdc451628dd2e5277281f01326e66816509199a86d
    Public key SHA-256 b84c353d68187e89a01884946b73c30a4835f4f94b0eb83c2b22d2d4908a68ad
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  35. earn.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    earn.trezor.im
    First seen
    2026-11-04 02:42 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-04 01:39 UTC to 2027-02-02 01:39 UTC
    Logged 2026-11-04 02:37 UTC in IPng Networks Halloumi2027h1, entry 355,983,376
    SHA-256 85aac274b000a735ace48c67b4c0b3ce940759223efb969cd8fa6368b985775d
    Public key SHA-256 2da5ec53fb5f091325fa6ec4f81b9106bc056aaabd5dab55143f0ecab5644c3e
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  36. data.trezor.im KN · AS402253 · SKN Subnet & Telecom Ltd
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    data.trezor.im
    First seen
    2026-11-04 02:42 UTC
    First published
    2026-11-04 03:04 UTC
    DNS
    Resolves · checked 2026-11-05 03:17 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 104.251.181.73.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 104.251.181.73
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-04 01:39 UTC to 2027-02-02 01:39 UTC
    Logged 2026-11-04 02:37 UTC in Google ParcelYard2027h1, entry 600,895,737
    SHA-256 0058f538fa817b60208fdc72c3ef1e0626305277b7365d03589de6c2a03e6133
    Public key SHA-256 1ba84a05cf46b4f4cf95813966572171465b5b533d92ee043090941305ae26b3
    Brand
    Trezor
    Addresses
    104.251.181.73 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Domain
    trezor.im
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  37. home--login-trezor-cd.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    home--login-trezor-cd.pages.dev
    First seen
    2026-11-03 23:15 UTC
    First published
    2026-11-04 00:32 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:45 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 22:14 UTC to 2027-02-01 23:14 UTC
    Logged 2026-11-03 23:14 UTC in Let's Encrypt Willow2027h1, entry 922,073,084
    SHA-256 3866c2d5c6130ff163c64741a44d44d577ce1f38c9d8dd7d63990775470017ff
    Public key SHA-256 fb849b7478e0ab1da09bc910cab401db05879acf3cc42c16316467c4b6aa38fc
    Brand
    Trezor
    Addresses
    172.66.44.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.103 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c99
    2606:4700:310c::ac42:2f67
    Cloudflare
    Cloudflare (172.66.44.153, 172.66.47.103): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  38. vault.deposit-trezor.io GB · AS212238 · CDNEXT Datacamp Limited2 addresses
    ListedPhishing hostUnder deposit-trezor.io, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 14 d ago
    DetailsHide
    Hostname
    vault.deposit-trezor.io
    First seen
    2026-11-03 23:00 UTC
    First published
    2026-11-03 23:22 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:34 UTC
    Listed
    MetaMask, listing deposit-trezor.io and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 152.233.50.1.
    1. Resolved to 152.233.50.1
    2. Phishing-host list fetched with the address
    Certificate
    Issued by YE1
    Valid 2026-11-03 22:00 UTC to 2027-02-01 22:00 UTC
    Logged 2026-11-03 22:59 UTC in Google PlumbersArms2027h1, entry 598,781,650
    SHA-256 22f7f3a1557bb29faef4eb856d3287970b73041c8098b4807f8f3955603d1b1e
    Public key SHA-256 a4ee242579a9436cec0b7b983a241f7fac65f2971b5937636392ddf8878be521
    Brand
    Trezor
    Addresses
    152.233.50.1 · United Kingdom · AS212238 CDNEXT Datacamp Limited
    2a02:6ea0:e237::1503:1
    Domain
    deposit-trezor.io
    Registered
    2026-10-22 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  39. trezor-secure-app.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-secure-app.wasmer.app
    First seen
    2026-11-03 21:37 UTC
    First published
    2026-11-03 21:49 UTC
    DNS
    Resolves · checked 2026-11-04 21:56 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 20:35 UTC to 2027-02-01 20:35 UTC
    Logged 2026-11-03 21:34 UTC in Google ParcelYard2027h1, entry 597,406,029
    SHA-256 b83524c9552f5054610f246c9c89d5b31e8d21dc965b29e0dd59b03f6ce0e4d0
    Public key SHA-256 297d8503e24a3e8e4d762a4c54232dda4ee4a82dd0b49554452a1eaf86d786c8
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  40. trezor-iostvr.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-iostvr.wasmer.app
    First seen
    2026-11-03 21:29 UTC
    First published
    2026-11-03 21:49 UTC
    DNS
    Resolves · checked 2026-11-04 21:56 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 20:21 UTC to 2027-02-01 20:21 UTC
    Logged 2026-11-03 21:20 UTC in Google ParcelYard2027h1, entry 597,243,097
    SHA-256 b657da502fdd5d0e0c5bf2b15cafe43fc72e6dc6146f91ade5457e46a1bbb731
    Public key SHA-256 39643a017d5da5be1c8bc6168f852f7bc71e608651d0572073c4147227c195f2
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  41. ticketdetail-trezor.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 d ago
    DetailsHide
    Hostname
    ticketdetail-trezor.com
    First seen
    2026-11-03 17:49 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-03 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 23:09 UTC to 2027-02-01 00:07 UTC
    Logged 2026-11-03 00:09 UTC in DigiCert Wyvern2027h1, entry 383,150,753
    SHA-256 d5250b128ce48afd826b1b1db444d8c9a24a913f8152e5d4a5cba5fdd5149585
    Public key SHA-256 076382f1d2b7751044d6e5e2cc1671f1c9c19cf8e72bdb14c4c790d879094f50
    Brand
    Trezor
    Addresses
    104.21.69.243 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.216.15 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:45f3
    2606:4700:3037::ac43:d80f
    Cloudflare
    Cloudflare (104.21.69.243, 172.67.216.15): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    ticketdetail-trezor.com
    Registered
    2026-11-03 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  42. trezor-suitetrezor.us US · AS53667 · FranTech Solutions2 addresses
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    trezor-suitetrezor.us
    First seen
    2026-11-03 17:36 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 16:34 UTC to 2027-02-01 16:34 UTC
    Logged 2026-11-03 17:32 UTC in DigiCert Wyvern2027h1, entry 391,322,360
    SHA-256 7c744a70b61221e244d478de2c87fe7dfc4dd584ac6dde4157a0004b71d8cc6e
    Public key SHA-256 00b6cca3eb7c7bf5b6bd810eb332813abd07c79d23263904ae3f3a5d171b52af
    Brand
    Trezor
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    trezor-suitetrezor.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at trezor-suitetrezor.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  43. www.ledgerlive-ledgers.us.trezor-suitetrezor.us US · AS53667 · FranTech Solutions
    ListedPhishing hostSame certificateUnder trezor-suitetrezor.us, listed by MetaMask · Address hosted confirmed phishing in the last 48 h · Same certificate as ledgerlive-ledgers.us, reported by PhishDestroy · Same certificate as ledgerlive-ledgers.us, reported by PhishDestroyMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    www.ledgerlive-ledgers.us.trezor-suitetrezor.us
    First seen
    2026-11-03 17:36 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask, listing trezor-suitetrezor.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    3. Latest DNS check
    Same certificate
    Same certificate as ledgerlive-ledgers.us: reported by PhishDestroy; on a phishing host at 198.251.89.144; a Ledger lookalike
    Hosting-alias name of ledgerlive-ledgers.us
    Trezor appears in this hostname
    Resolved to 198.251.89.144, an address that hosted confirmed phishing
    2 of 3 domains on this certificate have their own listing evidence
    Certificate 7c744a70b61221e2… · 3 domains on it · first seen 2026-11-03 17:36 UTC
    Same certificate
    Same certificate as ledgerlive-ledgers.us: reported by PhishDestroy; on a phishing host at 198.251.89.144; a Ledger lookalike
    Hosting-alias name of ledgerlive-ledgers.us
    Trezor appears in this hostname
    Resolved to 198.251.89.144, an address that hosted confirmed phishing
    2 of 3 domains on this certificate have their own listing evidence
    Certificate 7c744a70b61221e2… · 3 domains on it · first seen 2026-11-03 17:36 UTC
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 16:34 UTC to 2027-02-01 16:34 UTC
    Logged 2026-11-03 17:32 UTC in DigiCert Wyvern2027h1, entry 391,322,360
    SHA-256 7c744a70b61221e244d478de2c87fe7dfc4dd584ac6dde4157a0004b71d8cc6e
    Public key SHA-256 00b6cca3eb7c7bf5b6bd810eb332813abd07c79d23263904ae3f3a5d171b52af
    Brand
    Trezor
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    Domain
    trezor-suitetrezor.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at trezor-suitetrezor.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  44. us.trezor-suitetrezor.us
    ListedUnder trezor-suitetrezor.us, listed by MetaMaskMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    us.trezor-suitetrezor.us
    First seen
    2026-11-03 17:36 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask, listing trezor-suitetrezor.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-03 16:34 UTC to 2027-02-01 16:34 UTC
    Logged 2026-11-03 17:32 UTC in DigiCert Wyvern2027h1, entry 391,322,360
    SHA-256 7c744a70b61221e244d478de2c87fe7dfc4dd584ac6dde4157a0004b71d8cc6e
    Public key SHA-256 00b6cca3eb7c7bf5b6bd810eb332813abd07c79d23263904ae3f3a5d171b52af
    Brand
    Trezor
    Domain
    trezor-suitetrezor.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at trezor-suitetrezor.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  45. mobile-trezor.io PT · AS207731 · DiamWall DIAMWALL, LDA
    ListedPhishing hostListed by MetaMask · Address hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 34 d ago
    DetailsHide
    Hostname
    mobile-trezor.io
    First seen
    2026-11-03 17:05 UTC
    First published
    2026-11-03 18:16 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 216.146.31.1.
    1. Phishing-host list fetched with the address
    2. Resolved to 216.146.31.1
    3. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 16:04 UTC to 2027-02-01 16:04 UTC
    Logged 2026-11-03 17:02 UTC in Google PlumbersArms2027h1, entry 594,147,824
    SHA-256 3a30bf9065abaa7b3555be64cc5dbef8b892703f85e1d23f521f603d077aebea
    Public key SHA-256 7778ae31616961715ecf10f94e900d4131fbc0bc8cd088f580aca2727e068156
    Brand
    Trezor
    Addresses
    216.146.31.1 · Portugal · AS207731 DiamWall DIAMWALL, LDA
    Domain
    mobile-trezor.io
    Registered
    2026-10-02 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

  46. wildcard.trezor-bridge-hub.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    wildcard.trezor-bridge-hub.wasmer.app
    First seen
    2026-11-03 16:27 UTC
    First published
    2026-11-03 16:45 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 15:26 UTC to 2027-02-01 15:26 UTC
    Logged 2026-11-03 16:24 UTC in Google PlumbersArms2027h1, entry 593,660,174
    SHA-256 b6450b1c38f7e3cee2a87a7cf819fa9daa55a8ba464f30555614e813261b8391
    Public key SHA-256 9bf952a2aa3bce7a1c9846b5b4f193c76f23e3b9a5007f41dafaccfc71e269cf
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  47. cpanel.trezor-suitetrezor.us US · AS53667 · FranTech Solutions2 addresses
    ListedPhishing hostUnder trezor-suitetrezor.us, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    cpanel.trezor-suitetrezor.us
    First seen
    2026-11-03 16:21 UTC
    First published
    2026-11-03 16:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Listed
    MetaMask, listing trezor-suitetrezor.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-03 15:21 UTC to 2027-02-01 15:21 UTC
    Logged 2026-11-03 16:19 UTC in Let's Encrypt Sycamore2027h1, entry 924,884,123
    SHA-256 634f83136cdbc190a3db4e6b6746c0487c4796fe85327f3cfb2997f974e62f36
    Public key SHA-256 9245fef6b372370c1663ec8944553975a7b9056c5002545f92ed72fd04907408
    Brand
    Trezor
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    trezor-suitetrezor.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at trezor-suitetrezor.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  48. trezor-bridge-hub.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-bridge-hub.wasmer.app
    First seen
    2026-11-03 15:57 UTC
    First published
    2026-11-03 16:45 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 14:56 UTC to 2027-02-01 14:56 UTC
    Logged 2026-11-03 15:54 UTC in Let's Encrypt Sycamore2027h1, entry 924,539,145
    SHA-256 c47e37941d275e26e1e3ab85038e421ea624f5e3adf648ccb3ee68c07f78ad2b
    Public key SHA-256 2d6690f7b29bdf42b583a85ed486f5d8b2d6fef6bcb068807883a1f3c63aeebf
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  49. www.total-av.us.trezor-suitetrezor.us US · AS53667 · FranTech Solutions2 addresses
    ListedPhishing hostUnder trezor-suitetrezor.us, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    www.total-av.us.trezor-suitetrezor.us
    First seen
    2026-11-03 15:51 UTC
    First published
    2026-11-03 16:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Listed
    MetaMask, listing trezor-suitetrezor.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Certificate
    Issued by YR1
    Valid 2026-11-03 14:50 UTC to 2027-02-01 14:50 UTC
    Logged 2026-11-03 15:48 UTC in Google ParcelYard2027h1, entry 592,740,332
    SHA-256 598cebccb3d5282a192a471275f47a92438423845d1ff0fde1c3fd1c48abb8cc
    Public key SHA-256 d59b96bc781791f5b15727ca1085e5a70ff14b613809db9c817a29ce605d0df8
    Brand
    Trezor
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    trezor-suitetrezor.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at trezor-suitetrezor.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  50. cpcontacts.trezor-suitetrezor.us US · AS53667 · FranTech Solutions2 addresses
    ListedPhishing hostUnder trezor-suitetrezor.us, listed by MetaMask · Address hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 15 mo ago
    DetailsHide
    Hostname
    cpcontacts.trezor-suitetrezor.us
    First seen
    2026-11-03 15:51 UTC
    First published
    2026-11-03 16:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 16:55 UTC
    Listed
    MetaMask, listing trezor-suitetrezor.us and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 198.251.89.144.
    1. Phishing-host list fetched with the address
    2. Resolved to 198.251.89.144
    Certificate
    Issued by YR2
    Valid 2026-11-03 14:51 UTC to 2027-02-01 14:51 UTC
    Logged 2026-11-03 15:50 UTC in Google PlumbersArms2027h1, entry 593,212,534
    SHA-256 b8baf2b2bb2b389ca0a5ce51e18804a20a1c918b38080ef3bb6a7fd0fa8b3343
    Public key SHA-256 ed4ed481ad8a60e44b1f3b81084abff6e67553807783864633dd43f189a155d8
    Brand
    Trezor
    Addresses
    198.251.89.144 · United States · AS53667 PONYNET - FranTech Solutions
    173.211.81.11 · United States · AS396356 LATITUDE-SH - Latitude.sh
    Domain
    trezor-suitetrezor.us
    Registered
    2025-08-06 · eNom, LLC
    MX
    Receives mail at trezor-suitetrezor.us
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  51. io-start-trezor-een.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    io-start-trezor-een.pages.dev
    First seen
    2026-11-03 14:57 UTC
    First published
    2026-11-03 15:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-03 00:00 UTC to 2027-01-30 19:44 UTC
    Logged 2026-11-03 14:54 UTC in Geomys Tuscolo2027h1, entry 460,486,757
    SHA-256 bdaa2446551fa32284baf4a419acd8ea4db3b5ca05dbea001c6de9b5b1df5141
    Public key SHA-256 01f2d03ce83ee47d45d1f9c082ca20faa39e31cbf6e69dd48267a0e096dea982
    Brand
    Trezor
    Addresses
    172.66.44.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c3d
    2606:4700:310c::ac42:2fc3
    Cloudflare
    Cloudflare (172.66.44.61, 172.66.47.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  52. trezor-com-start.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-com-start.pages.dev
    First seen
    2026-11-03 14:42 UTC
    First published
    2026-11-03 15:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-03 00:00 UTC to 2027-01-29 22:47 UTC
    Logged 2026-11-03 14:37 UTC in Let's Encrypt Sycamore2027h1, entry 923,509,042
    SHA-256 0db0d8355743af81ee76ef06e32a280a0aced391ca938d473bd8087b2a43fb17
    Public key SHA-256 96ec9685566aa5bcc99498eaf3ebdc327acc50d6acffe8987cec80ede8b42769
    Brand
    Trezor
    Addresses
    172.66.44.99 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.157 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c63
    2606:4700:310c::ac42:2f9d
    Cloudflare
    Cloudflare (172.66.44.99, 172.66.47.157): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  53. trezor-suile.org US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    trezor-suile.org
    First seen
    2026-11-03 14:36 UTC
    First published
    2026-11-03 15:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:44 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 13:30 UTC to 2027-02-01 14:29 UTC
    Logged 2026-11-03 14:30 UTC in DigiCert Sphinx2027h1, entry 343,393,003
    SHA-256 6409b8f8334f86af9dd23c1bfcd2be671539a7b42484efab8487a94d43c07b79
    Public key SHA-256 4aaa4cd6aa786f6a33d26d7708bef652d6e4cf74d1ca4b4d26398f15ec86a8e5
    Brand
    Trezor
    Addresses
    104.21.29.119 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.148.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:1d77
    2606:4700:3035::ac43:94f9
    Cloudflare
    Cloudflare (104.21.29.119, 172.67.148.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    trezor-suile.org
    Registered
    2026-09-05 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:19 UTC

    Suggest a correction

  54. wildcard.secure-bridge-trezor.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    wildcard.secure-bridge-trezor.wasmer.app
    First seen
    2026-11-03 13:17 UTC
    First published
    2026-11-03 14:30 UTC
    DNS
    Resolves · checked 2026-11-04 14:33 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 12:15 UTC to 2027-02-01 12:15 UTC
    Logged 2026-11-03 13:14 UTC in DigiCert Wyvern2027h1, entry 388,869,845
    SHA-256 b87cb59e57a1fb235607fae1889c7f134c320ad0a006ba789d5c751e30ef75d9
    Public key SHA-256 a2a9598a1fa21d7ebef861daa50980525d6881cc2b7386264b8a71b060eb169c
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  55. trezor-io-start-republic-dominicana.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-start-republic-dominicana.wasmer.app
    First seen
    2026-11-03 11:11 UTC
    First published
    2026-11-03 12:13 UTC
    DNS
    Resolves · checked 2026-11-04 12:24 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 10:10 UTC to 2027-02-01 10:10 UTC
    Logged 2026-11-03 11:09 UTC in Geomys Tuscolo2027h1, entry 458,095,881
    SHA-256 317ebced32a09417c76049941e514c1e6260403993c164bd65fbb33155458cae
    Public key SHA-256 303c60af93d8b3d2db8965adf895036186eab411f680c43f9277fb45bac9bd20
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  56. sso-io-trezor.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    sso-io-trezor.pages.dev
    First seen
    2026-11-03 10:35 UTC
    First published
    2026-11-03 11:04 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 09:33 UTC to 2027-02-01 10:31 UTC
    Logged 2026-11-03 10:33 UTC in Google PlumbersArms2027h1, entry 588,955,425
    SHA-256 9fe408f7002c9efe0da86bbcdc46d5a931b19f0f5b93e58e9dbfe33cac45d410
    Public key SHA-256 ab8794814d145da577f49c201b979e3414e3553d1e11dc0639b49399b87dfa01
    Brand
    Trezor
    Addresses
    172.66.44.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.56 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cc8
    2606:4700:310c::ac42:2f38
    Cloudflare
    Cloudflare (172.66.44.200, 172.66.47.56): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  57. app-trezor-start.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    app-trezor-start.pages.dev
    First seen
    2026-11-03 08:20 UTC
    First published
    2026-11-03 08:50 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 07:18 UTC to 2027-02-01 08:17 UTC
    Logged 2026-11-03 08:18 UTC in DigiCert Wyvern2027h1, entry 385,759,126
    SHA-256 eee9e7c1596c469c8f23e51e3a6eb546014eafc918ab63ab7f5042cdb96eca9d
    Public key SHA-256 5bae28daf3a46776ebfaef92b5c02d2bedd05e45bc2ed53601d0393bffc7e7f2
    Brand
    Trezor
    Addresses
    172.66.44.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.195 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c3d
    2606:4700:310c::ac42:2fc3
    Cloudflare
    Cloudflare (172.66.44.61, 172.66.47.195): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  58. trezor-io-start-haiti.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-start-haiti.wasmer.app
    First seen
    2026-11-03 07:36 UTC
    First published
    2026-11-03 07:43 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 06:32 UTC to 2027-02-01 06:32 UTC
    Logged 2026-11-03 07:31 UTC in Geomys Tuscolo2027h1, entry 455,772,804
    SHA-256 6ff740b3652c46bab766116cdcccdf037019d6fa01fef2896c19db0e55fde812
    Public key SHA-256 44123fef8e99b9ceb5eaac228f4708a7246a3db11ca587cecf42bea7f3d1a77d
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  59. now-trezor-suite.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    now-trezor-suite.pages.dev
    First seen
    2026-11-03 07:15 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 06:13 UTC to 2027-02-01 07:11 UTC
    Logged 2026-11-03 07:13 UTC in Let's Encrypt Sycamore2027h1, entry 917,075,476
    SHA-256 ebc45c8cc69eb8beb4c4f8693dbbe61a00712def7e1354f46a1ea0b052fe75d9
    Public key SHA-256 7e49d53a61647ca4e2d17526ab47635b5efb0c0825063e89a7edf8277b639629
    Brand
    Trezor
    Addresses
    172.66.44.250 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.6 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cfa
    2606:4700:310c::ac42:2f06
    Cloudflare
    Cloudflare (172.66.44.250, 172.66.47.6): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  60. trezor-experts-io-start.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-experts-io-start.pages.dev
    First seen
    2026-11-03 07:15 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-03 00:00 UTC to 2027-01-26 22:32 UTC
    Logged 2026-11-03 07:13 UTC in Geomys Tuscolo2027h1, entry 455,602,744
    SHA-256 2d7263c62d33ba86bf99760ed247cb0845989452174d0f5c3affbfc82a9b2443
    Public key SHA-256 fc928294cc32eb9412e75de898812b829d5dec5bb81f9b0ee8670f81039b4dd4
    Brand
    Trezor
    Addresses
    172.66.44.190 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.66 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cbe
    2606:4700:310c::ac42:2f42
    Cloudflare
    Cloudflare (172.66.44.190, 172.66.47.66): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  61. port-logon-trezor.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    port-logon-trezor.pages.dev
    First seen
    2026-11-03 06:56 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-03 00:00 UTC to 2027-01-23 16:21 UTC
    Logged 2026-11-03 06:55 UTC in Geomys Tuscolo2027h1, entry 455,439,444
    SHA-256 99af0a38da909b1f94961d2a41c477d19d7e5babeb7131658234e39cb0d19c3b
    Public key SHA-256 d9dc3ade0dff61c259b980bda920c0eaec22af640a4b7635528582e20e86e8f2
    Brand
    Trezor
    Addresses
    172.66.44.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2ca4
    2606:4700:310c::ac42:2f5c
    Cloudflare
    Cloudflare (172.66.44.164, 172.66.47.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  62. trezor-hiostart.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-hiostart.wasmer.app
    First seen
    2026-11-03 06:52 UTC
    First published
    2026-11-03 07:43 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 05:47 UTC to 2027-02-01 05:47 UTC
    Logged 2026-11-03 06:46 UTC in IPng Networks Halloumi2027h1, entry 345,349,412
    SHA-256 1bc3e93f485585b8fd4606985517d6ac1de87cf4ce9267782c03b65bde366e41
    Public key SHA-256 85910f935b2692be386beb9603283774e43fd163348ee46c781f2fd27bfe5e8a
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  63. trezor---io-start.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor---io-start.pages.dev
    First seen
    2026-11-03 04:56 UTC
    First published
    2026-11-03 05:26 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:38 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 03:54 UTC to 2027-02-01 04:53 UTC
    Logged 2026-11-03 04:54 UTC in Geomys Tuscolo2027h1, entry 454,289,722
    SHA-256 d608f38c631eb77e4b6203f50fcc54cfb8a50d4527032621749ed93ed9ea9b40
    Public key SHA-256 054123fc42dbd021da2d22a1e047c989f3f0b3fd0e6c04ccd589d68409d937b0
    Brand
    Trezor
    Addresses
    172.66.45.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d07
    2606:4700:310c::ac42:2ef9
    Cloudflare
    Cloudflare (172.66.45.7, 172.66.46.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  64. trezor-insurances.com SG · AS63949 · Akamai Connected Cloud3 addresses
    ListedAkamai LinodeParking page · ParkLogicListed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    trezor-insurances.com
    First seen
    2026-11-03 03:36 UTC
    First published
    2026-11-03 04:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 05:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-03 02:37 UTC to 2027-02-01 02:37 UTC
    Logged 2026-11-03 03:35 UTC in Google PlumbersArms2027h1, entry 583,652,886
    SHA-256 2cf892b4732ee9c9cc9beacfec2c3f9c3dcb0e5ba367bde55cfe9ba194c58aa8
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Trezor
    Addresses
    172.233.211.57 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.233.211.67 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.239.61.123 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.233.211.57, 172.233.211.67, 172.239.61.123): a cloud provider. It rents servers and addresses to its customers.
    Parking page · ParkLogic
    The registry delegates trezor-insurances.com to ParkLogic’s nameservers, which answer for it. ParkLogic: a parking service. It answers for names that are typically for sale or unused.
    Domain
    trezor-insurances.com
    Registered
    2025-10-01 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  65. users-trezor.io US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    users-trezor.io
    First seen
    2026-11-03 03:31 UTC
    First published
    2026-11-03 03:45 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:56 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 02:29 UTC to 2027-02-01 03:27 UTC
    Logged 2026-11-03 03:29 UTC in Google ParcelYard2027h1, entry 583,110,773
    SHA-256 a09111fedfce60f8b9dc32e080605d529d0249c655015cd50f2e5a03de64c074
    Public key SHA-256 313ff740dfa65b5ff6e6d296d33b5a9b87d86471aaeb438a0d2457abfcb9fb8a
    Brand
    Trezor
    Addresses
    104.21.68.107 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.194.72 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::ac43:c248
    2606:4700:3036::6815:446b
    Cloudflare
    Cloudflare (104.21.68.107, 172.67.194.72): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    users-trezor.io
    Registered
    2026-07-05 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:53 UTC

    Suggest a correction

  66. trezor-suit-web.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-suit-web.pages.dev
    First seen
    2026-11-03 01:16 UTC
    First published
    2026-11-03 02:31 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:45 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-03 00:00 UTC to 2027-01-28 20:35 UTC
    Logged 2026-11-03 01:11 UTC in Google Argon2027h1, entry 832,294,989
    SHA-256 743ba5657f96b598360048d1782fb8f5621e8e8b4dd36f31d30dc66d0864707c
    Public key SHA-256 2ee27f956d7abac817c793a19d9724a621cf5e6218a9440cc9c927b75ff171ce
    Brand
    Trezor
    Addresses
    172.66.45.26 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.230 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d1a
    2606:4700:310c::ac42:2ee6
    Cloudflare
    Cloudflare (172.66.45.26, 172.66.46.230): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  67. warrant-trezor.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 2 mo ago
    DetailsHide
    Hostname
    warrant-trezor.com
    First seen
    2026-11-03 00:56 UTC
    First published
    2026-11-03 01:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 01:34 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 23:53 UTC to 2027-02-01 00:49 UTC
    Logged 2026-11-03 00:53 UTC in IPng Networks Gouda2027h1, entry 297,822,265
    SHA-256 a06436856b0655da16e4e5fac9064010eca699e55c488e779ec67ba9db656096
    Public key SHA-256 4fb7b415354e3a0202f193e82596e315860e9b546e6e8a099ac7d607c7f80cac
    Brand
    Trezor
    Addresses
    104.21.86.236 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.137.213 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::ac43:89d5
    2606:4700:3036::6815:56ec
    Cloudflare
    Cloudflare (104.21.86.236, 172.67.137.213): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    warrant-trezor.com
    Registered
    2026-09-04 · Dynadot Inc
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:41 UTC

    Suggest a correction

  68. trezor-io-strat-iss.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-strat-iss.wasmer.app
    First seen
    2026-11-03 00:52 UTC
    First published
    2026-11-03 01:20 UTC
    DNS
    Resolves · checked 2026-11-05 01:34 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 23:51 UTC to 2027-01-31 23:51 UTC
    Logged 2026-11-03 00:49 UTC in Geomys Tuscolo2027h1, entry 452,128,082
    SHA-256 207a2c4a0dafbef9e19ff664254013e8e070ed153b0b10176d57847f27526200
    Public key SHA-256 d75034841a33de4a301a5d73b462d4cd6ac282e929d9bc3b82d4f04a9f03fd24
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  69. trezor-loginin.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-loginin.pages.dev
    First seen
    2026-11-02 22:26 UTC
    First published
    2026-11-02 23:02 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 23:12 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-28 16:17 UTC
    Logged 2026-11-02 22:23 UTC in Geomys Tuscolo2027h1, entry 450,733,988
    SHA-256 6b0b093b6256dc431ad5f868729f7d2f13bdd154aa6a1bec07693248299b825b
    Public key SHA-256 0bcc956c14d6cc50df8ad2a6b5a9a1056a96b231c34b91cc03a2b37f9724bc55
    Brand
    Trezor
    Addresses
    172.66.44.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.139 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c75
    2606:4700:310c::ac42:2f8b
    Cloudflare
    Cloudflare (172.66.44.117, 172.66.47.139): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  70. secure-bridge-trezor.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    secure-bridge-trezor.wasmer.app
    First seen
    2026-11-02 20:42 UTC
    First published
    2026-11-02 21:07 UTC
    DNS
    Resolves · checked 2026-11-04 21:19 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 19:39 UTC to 2027-01-31 19:39 UTC
    Logged 2026-11-02 20:37 UTC in DigiCert Wyvern2027h1, entry 382,050,922
    SHA-256 7904c293a3caf8da56679da678b04b0750cb28c1404b04ef4a098d99de09d9a7
    Public key SHA-256 bc6a2ab0815e60f224a994356ff3faff98011670fef4378fcd9ecee9b70984b2
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  71. trezor-faq-support-help.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-faq-support-help.wasmer.app
    First seen
    2026-11-02 18:57 UTC
    First published
    2026-11-02 19:15 UTC
    DNS
    Resolves · checked 2026-11-04 19:29 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 17:54 UTC to 2027-01-31 17:54 UTC
    Logged 2026-11-02 18:52 UTC in Let's Encrypt Willow2027h1, entry 900,709,376
    SHA-256 ae0631d4b5e07d9706e4e2fb06bb7ee572df51cd1afc585e2cb99a5ad45857b1
    Public key SHA-256 1fea37a1f17252a14f94da8a33834246e540d1066f4d3250e515b24f6c2fdb89
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  72. trezor----hardware--wallet.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor----hardware--wallet.pages.dev
    First seen
    2026-11-02 16:51 UTC
    First published
    2026-11-02 18:02 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:10 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 15:48 UTC to 2027-01-31 16:46 UTC
    Logged 2026-11-02 16:48 UTC in Geomys Tuscolo2027h1, entry 447,653,598
    SHA-256 4f511dcf62d430dc573835edd71c3dfdb06a284453e91bb75b91a65976e7dea3
    Public key SHA-256 59ada2b9cef75ba33a1b742285a1d43c4703d446d1ae305b4b7868605a230b0e
    Brand
    Trezor
    Addresses
    172.66.44.138 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.118 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c8a
    2606:4700:310c::ac42:2f76
    Cloudflare
    Cloudflare (172.66.44.138, 172.66.47.118): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  73. support-faq-trezor.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    support-faq-trezor.wasmer.app
    First seen
    2026-11-02 15:01 UTC
    First published
    2026-11-02 15:44 UTC
    DNS
    Resolves · checked 2026-11-04 15:58 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 14:00 UTC to 2027-01-31 14:00 UTC
    Logged 2026-11-02 14:59 UTC in Google PlumbersArms2027h1, entry 574,401,150
    SHA-256 b16bd2589fdd6270906024c0a83260351a18d082a2c8348625ef3ec948aa6bd0
    Public key SHA-256 e9541e416b94b504cc2ec4d5549ccd719994d11969f3d1d0df2a30accf313c56
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  74. www.trezor-insurances.com SG · AS63949 · Akamai Connected Cloud3 addresses
    ListedAkamai LinodeParking page · ParkLogicUnder trezor-insurances.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 13 mo ago
    DetailsHide
    Hostname
    www.trezor-insurances.com
    First seen
    2026-11-02 15:00 UTC
    First published
    2026-11-02 15:44 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:58 UTC
    Listed
    MetaMask, listing trezor-insurances.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 13:57 UTC to 2027-01-31 13:57 UTC
    Logged 2026-11-02 14:56 UTC in Geomys Tuscolo2027h1, entry 446,588,483
    SHA-256 0d78754508e243357b04a05044b10abd1fcd86ade0be28381e03856f2dfd9b8a
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Trezor
    Addresses
    172.233.211.57 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.233.211.67 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.239.61.123 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.233.211.57, 172.233.211.67, 172.239.61.123): a cloud provider. It rents servers and addresses to its customers.
    Parking page · ParkLogic
    The registry delegates trezor-insurances.com to ParkLogic’s nameservers, which answer for it. ParkLogic: a parking service. It answers for names that are typically for sale or unused.
    Domain
    trezor-insurances.com
    Registered
    2025-10-01 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 16:53 UTC

    Suggest a correction

  75. trezor--s--uite.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor--s--uite.pages.dev
    First seen
    2026-11-02 14:26 UTC
    First published
    2026-11-02 15:44 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 15:58 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 13:22 UTC to 2027-01-31 14:20 UTC
    Logged 2026-11-02 14:22 UTC in IPng Networks Gouda2027h1, entry 294,090,056
    SHA-256 c2c34e7e1a6de098fdeea8f676f5f64faa3d195e14ceaf52c711285c0f93c7b0
    Public key SHA-256 7b8c12c4f735ee3f31d9788558866191733aa164973d257817fdc8b6478b9af1
    Brand
    Trezor
    Addresses
    172.66.44.168 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.88 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2ca8
    2606:4700:310c::ac42:2f58
    Cloudflare
    Cloudflare (172.66.44.168, 172.66.47.88): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  76. trezor.com.ag US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    trezor.com.ag
    First seen
    2026-11-02 13:41 UTC
    First published
    2026-11-02 14:21 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 12:37 UTC to 2027-01-31 13:36 UTC
    Logged 2026-11-02 13:37 UTC in Google ParcelYard2027h1, entry 572,826,372
    SHA-256 4bf04f9687a04efd09a5c2d3b2310ab65a57568e5dcdbc67c95a6fa3eaf06292
    Public key SHA-256 1ee2041109ac6f888b0247044ca2aa8620cf3863fbb3b081da8512b100d06a6e
    Brand
    Trezor
    Addresses
    104.21.47.61 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.145.58 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:2f3d
    2606:4700:3034::ac43:913a
    Cloudflare
    Cloudflare (104.21.47.61, 172.67.145.58): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    trezor.com.ag
    Registered
    2026-04-25 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  77. trezor-io-start-saint-vincent-and-grenadines.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-start-saint-vincent-and-grenadines.wasmer.app
    First seen
    2026-11-02 13:32 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 12:27 UTC to 2027-01-31 12:27 UTC
    Logged 2026-11-02 13:26 UTC in Google ParcelYard2027h1, entry 572,674,732
    SHA-256 dd92de8e62ad787583c90f11ce90122276c3f956aab4db83a49fc32ae8af92ed
    Public key SHA-256 0611cb1cc3029bb52a44b2347d7d2305a826a1717a2550e2ccf711a980c7faa8
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  78. trezor-log-in-web-help.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-log-in-web-help.pages.dev
    First seen
    2026-11-02 11:10 UTC
    First published
    2026-11-02 12:24 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 12:35 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-02 00:00 UTC to 2027-01-15 08:29 UTC
    Logged 2026-11-02 11:09 UTC in HARICA Selene2027h1, entry 45,180,812
    SHA-256 352bf70d7930c01b636c6d5e24023a964d41163ce172e51609862bf595228b7e
    Public key SHA-256 b3a837b86c4c86682af21165dbdab0599c45a8b4dcd11dd4b11bf43d7b1c5696
    Brand
    Trezor
    Addresses
    172.66.44.177 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.79 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2cb1
    2606:4700:310c::ac42:2f4f
    Cloudflare
    Cloudflare (172.66.44.177, 172.66.47.79): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  79. trezor-io-start-suriname.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-start-suriname.wasmer.app
    First seen
    2026-11-02 11:06 UTC
    First published
    2026-11-02 12:24 UTC
    DNS
    Resolves · checked 2026-11-04 12:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 10:04 UTC to 2027-01-31 10:04 UTC
    Logged 2026-11-02 11:02 UTC in IPng Networks Halloumi2027h1, entry 337,718,524
    SHA-256 b1b8f0cd02e4966bbf47190ba7129215f8e3cf458d32a84df79e694b328e6c86
    Public key SHA-256 9553d586edac1bfde6a43c7bf6a859362f663dc536072be92a9284238f748eca
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  80. trezor-io-start-guyana.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-io-start-guyana.wasmer.app
    First seen
    2026-11-02 11:06 UTC
    First published
    2026-11-02 12:24 UTC
    DNS
    Resolves · checked 2026-11-04 12:35 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-02 10:04 UTC to 2027-01-31 10:04 UTC
    Logged 2026-11-02 11:02 UTC in Let's Encrypt Sycamore2027h1, entry 902,361,052
    SHA-256 2dc7d446bcb812eb03c92a0ac8932ba93bd25b87bd11b59df682af0f091b43af
    Public key SHA-256 2d33de63ff426ddeab57669bca18fbabf7c405e6c11906352436cd9d0dc9c6c6
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  81. trezor-suite--doc-e1i.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezor-suite--doc-e1i.pages.dev
    First seen
    2026-11-02 10:40 UTC
    First published
    2026-11-02 11:09 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 11:24 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-22 05:41 UTC
    Logged 2026-11-02 10:37 UTC in DigiCert Wyvern2027h1, entry 379,109,765
    SHA-256 4ee681b9b7859b633d2b135d8bb262b213f986de4460a83253aa5001c48c7400
    Public key SHA-256 40b1f537a950929005a6d25b4aefb1f0f56300a1e480d1d64ce5ebd9ea598c71
    Brand
    Trezor
    Addresses
    172.66.45.7 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.249 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d07
    2606:4700:310c::ac42:2ef9
    Cloudflare
    Cloudflare (172.66.45.7, 172.66.46.249): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  82. www.update-trezor.cz DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ListedParking page · ParkingCrew (Team Internet)Under update-trezor.cz, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 10 d ago
    DetailsHide
    Hostname
    www.update-trezor.cz
    First seen
    2026-11-02 08:10 UTC
    First published
    2026-11-02 08:38 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 08:52 UTC
    Listed
    MetaMask, listing update-trezor.cz and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-02 07:09 UTC to 2027-01-31 07:09 UTC
    Logged 2026-11-02 08:08 UTC in Google ParcelYard2027h1, entry 568,359,857
    SHA-256 3785a065a2520498547290c9da42ff8e29fca097cc1a9028726107ea05de740b
    Public key SHA-256 d7019137a016106fc8349a38f7f4334757b94b7b66aced537266d8ab555cb14c
    Brand
    Trezor
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    update-trezor.cz
    Registered
    2026-10-26 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  83. start-trezor.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    start-trezor.wasmer.app
    First seen
    2026-11-02 07:07 UTC
    First published
    2026-11-02 08:00 UTC
    DNS
    Resolves · checked 2026-11-05 08:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 06:05 UTC to 2027-01-31 06:05 UTC
    Logged 2026-11-02 07:04 UTC in IPng Networks Gouda2027h1, entry 291,506,208
    SHA-256 afd58e24cae04385c28f2150a046884257022ab965a2fdc645209aaf35ad575c
    Public key SHA-256 4b8b52c00b374f270f0a72198d32489a41af743c107d83ccc1d72646272f67b3
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  84. trezor-926401.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 22 d ago
    DetailsHide
    Hostname
    trezor-926401.com
    First seen
    2026-11-02 03:56 UTC
    First published
    2026-11-02 04:28 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:42 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-16 08:17 UTC
    Logged 2026-11-02 03:54 UTC in Let's Encrypt Willow2027h1, entry 889,778,739
    SHA-256 81d3318dbf5ae8ce225ed5055538ecd882b9a14a885cdffb30175c710489b82e
    Public key SHA-256 cb146b59e6b1fe1ce585351af675a2fc8394d144fbfcbcb389fb152b95568bdc
    Brand
    Trezor
    Addresses
    104.21.95.90 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.170.63 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:5f5a
    2606:4700:3033::ac43:aa3f
    Cloudflare
    Cloudflare (104.21.95.90, 172.67.170.63): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    trezor-926401.com
    Registered
    2026-10-14 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  85. trezor-suite-nies-depv.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    trezor-suite-nies-depv.wasmer.app
    First seen
    2026-11-02 03:42 UTC
    First published
    2026-11-02 04:28 UTC
    DNS
    Resolves · checked 2026-11-05 04:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-02 02:37 UTC to 2027-01-31 02:37 UTC
    Logged 2026-11-02 03:36 UTC in IPng Networks Halloumi2027h1, entry 334,986,356
    SHA-256 3d0034e6775e6b78f05eaced002cb54166dcf17bda061f47dcfe7ac001153128
    Public key SHA-256 6ee54906b0a21451f04bee5e37b45b4b21f5441b9edff638770ac274fc58b827
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  86. app-trezor-suite.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    app-trezor-suite.pages.dev
    First seen
    2026-11-02 03:36 UTC
    First published
    2026-11-02 04:28 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 04:42 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-02 00:00 UTC to 2027-01-13 06:13 UTC
    Logged 2026-11-02 03:34 UTC in Google ParcelYard2027h1, entry 565,359,049
    SHA-256 a75267cc4ce5c2581e55fce343e152a23eefa30f6245d8fe7eaaba8c02db75d2
    Public key SHA-256 76490101eb52ab20eb556e53c2a44e446ac6cdc71b3a1d3465ecaab691ea5a86
    Brand
    Trezor
    Addresses
    172.66.45.8 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.46.248 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2d08
    2606:4700:310c::ac42:2ef8
    Cloudflare
    Cloudflare (172.66.45.8, 172.66.46.248): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  87. connect-trezor-suite-duq.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    connect-trezor-suite-duq.pages.dev
    First seen
    2026-11-02 02:26 UTC
    First published
    2026-11-02 03:20 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 03:30 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-02 01:22 UTC to 2027-01-31 02:19 UTC
    Logged 2026-11-02 02:22 UTC in IPng Networks Halloumi2027h1, entry 334,594,945
    SHA-256 92e42d651c0924f70e200fff26ef56fa4795e05aee87e14ef7f24ed955661b34
    Public key SHA-256 7eb4147c608905c1418b21f7607ab20319a4c5d9730459a35127a6310491e3b4
    Brand
    Trezor
    Addresses
    172.66.44.98 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.158 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c62
    2606:4700:310c::ac42:2f9e
    Cloudflare
    Cloudflare (172.66.44.98, 172.66.47.158): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  88. assistance-trezor.io US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    assistance-trezor.io
    First seen
    2026-11-02 01:20 UTC
    First published
    2026-11-02 02:12 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 02:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-02 00:19 UTC to 2027-01-31 00:19 UTC
    Logged 2026-11-02 01:18 UTC in Google ParcelYard2027h1, entry 563,969,116
    SHA-256 09681853ddf2089a7cb68a20c216f793e7ed459bebf81baf124412c853e11aac
    Public key SHA-256 bab1995b0d71a3542b826ebdb4e4ac70d9a544f751f238e83ea01a7cefc6cf15
    Brand
    Trezor
    Addresses
    104.21.92.203 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.197.179 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:5ccb
    2606:4700:3034::ac43:c5b3
    Cloudflare
    Cloudflare (104.21.92.203, 172.67.197.179): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    assistance-trezor.io
    Registered
    2026-08-03 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  89. trezorwallet--docs.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMask
    DetailsHide
    Hostname
    trezorwallet--docs.pages.dev
    First seen
    2026-11-01 23:05 UTC
    First published
    2026-11-01 23:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:06 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-11-01 00:00 UTC to 2027-01-20 06:59 UTC
    Logged 2026-11-01 23:01 UTC in Sectigo Elephant2027h1, entry 672,448,504
    SHA-256 0047b0ad7c7afaf896a1fa36d31691706030800c4c1efb71e45ffd7c29343f1d
    Public key SHA-256 e82f425ea9bed96d4e5bc6edf3122a500fca8494259506060e2d465cd1f229ac
    Brand
    Trezor
    Addresses
    172.66.44.164 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.92 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2ca4
    2606:4700:310c::ac42:2f5c
    Cloudflare
    Cloudflare (172.66.44.164, 172.66.47.92): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  90. support-help-trezor-faq.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    support-help-trezor-faq.wasmer.app
    First seen
    2026-11-01 19:42 UTC
    First published
    2026-11-01 20:16 UTC
    DNS
    Resolves · checked 2026-11-04 20:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-01 18:38 UTC to 2027-01-30 18:38 UTC
    Logged 2026-11-01 19:36 UTC in Google PlumbersArms2027h1, entry 560,545,419
    SHA-256 278a0d7a4a8864f958929541d89ebb8506eda102a1209519768a21aed6d1e635
    Public key SHA-256 315610e95c4c4c8d1d2f4697dc19af08719796e66f57a2d6a73ed25cd43fa044
    Brand
    Trezor
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  91. eu-trezor.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 3 mo ago
    DetailsHide
    Hostname
    eu-trezor.com
    First seen
    2026-11-01 18:47 UTC
    First published
    2026-11-01 19:10 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 19:20 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-01-16 11:59 UTC
    Logged 2026-11-01 18:42 UTC in IPng Networks Gouda2027h1, entry 287,628,274
    SHA-256 3db11815fa60e39ef6ba2dec543a8a8a2e1b050e475c37fd0e109ff014478de4
    Public key SHA-256 49cd72007e58d5d93e564a3513a87ba9eb83bfdc18c63cc40d8e3d8cc20007e8
    Brand
    Trezor
    Addresses
    104.21.14.200 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.160.135 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:ec8
    2606:4700:3031::ac43:a087
    Cloudflare
    Cloudflare (104.21.14.200, 172.67.160.135): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    eu-trezor.com
    Registered
    2026-08-13 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  92. desktop-trezor.com AE · AS211273 · FZCO
    ListedListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 d ago
    DetailsHide
    Hostname
    desktop-trezor.com
    First seen
    2026-11-01 17:47 UTC
    First published
    2026-11-01 18:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving · checked 2026-11-05 10:21 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-31 17:09 UTC to 2027-01-29 17:09 UTC
    Logged 2026-10-31 18:08 UTC in Google PlumbersArms2027h1, entry 543,538,716
    SHA-256 a304e82d2044c78476675b1201effee2e50eb4f37e0ceedb15fee26d598ba4f4
    Public key SHA-256 84451e9c80440de620e893ca62bc174d01b1bc4455087f571b1ee7290c611d4c
    Brand
    Trezor
    Addresses
    46.8.102.227 · United Arab Emirates · AS211273 csoft Cloud Software - FZCO
    Domain
    desktop-trezor.com
    Registered
    2026-10-31 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  93. insurance-trezor.com US · AS13335 · Cloudflare, Inc.4 addresses
    ListedCloudflareListed by MetaMaskMX absentSPF missingDMARC missingRegistered 5 d ago
    DetailsHide
    Hostname
    insurance-trezor.com
    First seen
    2026-11-01 17:47 UTC
    First published
    2026-11-01 18:03 UTC
    Listing
    MetaMask: first observed in the feed 2026-11-01 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-04 18:08 UTC
    Listed
    MetaMask
    1. Certificate logged in CT
    2. Observed in the MetaMask feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by Cloudflare TLS Issuing ECC CA 4 · precertificate
    Valid 2026-10-31 22:06 UTC to 2027-01-29 22:14 UTC
    Logged 2026-10-31 22:16 UTC in DigiCert Sphinx2027h1, entry 325,051,878
    SHA-256 0c5d62b7d439edf0691a48d929794aaf914f080dc878a0b9265172e73a9b6c76
    Public key SHA-256 01c665fcfe4c1d7ac7b0ce149b0681399cd8070b436ece6106b548e9de14226d
    Brand
    Trezor
    Addresses
    104.21.19.24 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.229 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:1318
    2606:4700:3037::ac43:b8e5
    Cloudflare
    Cloudflare (104.21.19.24, 172.67.184.229): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    insurance-trezor.com
    Registered
    2026-10-31 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 18:19 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Trezor when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Crypto & web3

All brands →