trezzor-us-wallet[.]webflow[.]io

This domain, trezzor-us-wallet.webflow.io, is flagged for brand_impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The site remains active and operational, presenting a direct threat to users attempting to access legitimate Trezor services. Analysis indicates the domain was registered on May 8, 2013, though the current malicious activity suggests recent compromise or repurposing. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8 and is hosted under an SSL certificate issued by Google Trust Services. The registrar of record is MarkMonitor, Inc. Security vendor detections on VirusTotal show 6 of 95 engines flagging the domain as malicious, with no observed blocklist entries or trust score improvements since initial discovery. The domain continues to host a fraudulent Trezor wallet interface, likely designed to harvest cryptocurrency credentials or distribute malicious payloads. Users are advised to block all connections to 172.64.151.8 and trezzor-us-wallet.webflow.io at the network perimeter. Organizations should update endpoint detection rules to include this domain and IP in threat intelligence feeds. Verification of Trezor-related communications should be conducted exclusively through official channels, with particular scrutiny of any webflow.io-hosted resources claiming affiliation with the brand.