treziuor-iostartt[.]webflow[.]io

The domain treziuor-iostartt.webflow.io has been identified as a brand impersonation site specifically targeting Trezor, a popular hardware wallet provider. This threat is classified as elevated risk, though the site is currently offline. The page title, "Trezor.io/Start - Trezor Hardware Wallet," was designed to deceive users into believing they were accessing the legitimate Trezor start page.

Analysis reveals that this domain was created on June 15, 2026, and registered through MarkMonitor, Inc. It resolves to IP address 104.18.36.248 and uses an SSL certificate issued by Google Trust Services (WE1). VirusTotal flagged it with 5 out of 95 security vendors marking it as malicious, and it appears on 3 security blocklists. These indicators confirm the domain's malicious intent and its association with phishing campaigns.

Since the domain has been taken offline, the immediate risk is mitigated, but users should remain vigilant. PhishDestroy recommends that Trezor users always verify URLs before entering credentials or sensitive information. If you have interacted with this domain, change your Trezor-related passwords and enable two-factor authentication immediately. Report any suspicious domains to relevant authorities to help prevent future attacks.