trezzhdwrallet[.]webflow[.]io

The domain trezzhdwrallet.webflow.io was identified in a brand impersonation campaign targeting the cryptocurrency hardware wallet provider Trezor. This domain was designed to mimic an official source, potentially misleading users into divulging sensitive information. As of the latest update, the domain is offline, mitigating immediate threats to end-users.

This domain was flagged by 14 of 95 security vendors on VirusTotal, highlighting its recognition within the cybersecurity community. It was registered through MarkMonitor Inc., a registrar often associated with high-profile domain management. The domain resolved to IP address 172.64.151.8 and was created on June 15, 2026. It appeared on three security blocklists, including those maintained by MetaMask, PhishDestroy, and SEAL. An SSL certificate was issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users.

Given the domain's current offline status, the immediate threat has been neutralized. However, it is crucial for users to remain vigilant against such impersonation attempts. It is recommended that users verify URLs before entering any personal information, utilize browser-based security extensions that block known phishing sites, and regularly update security software to detect and prevent access to fraudulent domains.