URGENT: Active Trezor Crypto Phishing in .ORG Registry — en-trezor.org

[mrp300]

Dear Abuse & Security Team,

I am writing to submit an urgent phishing report regarding an active malicious domain registered under the .ORG TLD targeting Trezor Hardware Wallet users.

INFRASTRUCTURE DETAILS:

• Target Phishing Domain: en-trezor.org
• Target URL: https://en-trezor.org/
• Impersonated Brand: Trezor / Trezor Suite (Legitimate domain: trezor.io)
• Active Host/Proxy: Cloudflare, Inc.

THREAT DETAILS:
The domain en-trezor.org employs brand spoofing and prefix typosquatting ("en-trezor") to impersonate the official Trezor interface. The site is engineered to deceive victims into entering their 12/24-word Secret Recovery Seed Phrases or connecting wallets to drain cryptocurrency assets.

VIOLATIONS:

• Active cryptocurrency theft and credential harvesting.
• Unlawful trademark infringement and brand impersonation (Trezor).
• Direct violation of PIR (.ORG Registry) and Cloudflare Acceptable Use Policies (AUP).

REQUESTED ACTION:

1. Hold/suspend the domain en-trezor.org at the registry level (Public Interest Registry).
2. Terminate Cloudflare proxying and DNS resolution for en-trezor.org.
3. Submit this domain to global threat blacklists.

Regards,
Security Researcher