sso--trezoor-official[.]webflow[.]io

Analysis of sso--trezoor-official.webflow.io shows the site is actively serving content (HTTP 200) and is hosted behind Cloudflare (IP 172.64.151.8, CA). The domain was created on April 22, 2026 and is registered through Webflow, which also supplies the site’s technology stack (Webflow, Cloudflare, HTTP/3) and the SSL certificate issued by Google Trust Services / WE1. The page title advertised as "Trezor Wallet - The #1 Hardware Crypto Wallet" directly references the Trezor brand, matching the known intelligence that the domain is a brand‑impersonation campaign targeting Trezor users. Security telemetry indicates that 19 of 91 VirusTotal scanners have flagged the domain, and it is listed on at least one public blocklist. The domain has been identified and blocked by PhishDestroy, confirming that defensive feeds consider it malicious. Current risk is assessed as high and the status remains active. Defenders should add the domain to URL filtering rules, monitor DNS queries for the associated IP, and enforce blocklisting across intrusion‑prevention and web‑gateway solutions. Because the site is hosted on a legitimate CDN, direct IP blocking may affect other benign services; therefore, domain‑level controls are recommended. Continuous re‑evaluation is advised as further forensic evidence (e.g., payload analysis or user‑reported incidents) becomes available.