trerezrwwalletrtixv[.]webflow[.]io

This domain, trerezrwwalletrtixv.webflow.io, was designed to steal cryptocurrency from Trezor wallet users. It posed as an official Trezor wallet interface, tricking visitors into entering their recovery phrases or private keys. Once entered, attackers would drain the victim's crypto assets. The site used a convincing clone of the legitimate Trezor login page, with the title 'Trezor @Wallet | Bitcoin & Crypto Security' to appear authentic.

PhishDestroy identified this threat through multiple indicators. Security vendor analysis on VirusTotal shows that 15 out of 95 vendors flagged the domain as malicious. The domain was created on February 21, 2026, and registered through NameCheap, Inc. It resolved to IP address 104.18.36.248 and used an SSL certificate from Google Trust Services. The site appeared on at least one security blocklist before being taken offline. These technical clues confirm it was a phishing operation targeting Trezor users.

If you visited this site or entered any information, take immediate action. Do not enter your recovery phrase on any website unless you are certain of its authenticity. If you suspect your wallet is compromised, transfer your funds to a new wallet generated offline. Change passwords and enable two-factor authentication on related accounts. Report the incident to Trezor support and monitor your accounts for suspicious activity. Always verify wallet URLs directly through official sources and use PhishDestroy to check domain safety before interacting with crypto sites.