trecerwalleth[.]webflow[.]io

The domain trecerwalleth.webflow.io is currently active and classified as a brand impersonation phishing threat targeting Trezor, a well-known hardware wallet provider. This domain presents itself as an official Trezor platform, using page titles such as 'Trezor Wallet Hardware Wallet - Hardware Wallet - Wallet' to deceive users into believing they are interacting with legitimate services. The threat type is explicitly categorized as brand impersonation, designed to harvest sensitive credentials or financial information from unsuspecting victims. Analysis indicates the domain is flagged by 6 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. It appears on three security blocklists and is actively blocked by multiple detection systems. The domain was registered through MarkMonitor, Inc., and resolves to the IP address 172.64.151.8. Despite its creation date of May 8, 2013, the domain remains operational and continues to pose a high-risk threat. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to potential victims. Current infrastructure and detection metrics confirm that trecerwalleth.webflow.io remains an active threat. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to prevent access. Users should be alerted to verify the authenticity of any Trezor-related communications or websites, particularly those requesting sensitive information or wallet access. Monitoring for similar domains using the same registrar or hosting patterns is recommended to mitigate further risks associated with this impersonation campaign.