tterezrwallet[.]webflow[.]io

The domain tterezrwallet.webflow.io was created on May 08, 2013 and is registered through MarkMonitor, Inc. It resolves to the IP address 104.18.36.248, which is hosted within Cloudflare’s AS13335 network in the United States and served via the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The site presented a page title of "Trezor* Wallet@ - The official wallet," explicitly targeting the Trezor brand and was classified as a crypto scam. The SSL certificate was issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint, while the HTTP response returned a 404 status code, suggesting the content is no longer accessible.

Technical fingerprints reveal the use of Cloudflare services and HTTP/3 protocol. Threat intelligence indicates that 14 of 95 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist. The domain has been blocked by PhishDestroy and is currently listed as offline.

While the historical data confirms the presence of brand impersonation and malicious infrastructure, real‑time activity cannot be observed due to the offline status. Defenders should retain the indicator set—including the domain name, resolved IP, registrar, SSL issuer, and detection counts—in their threat‑intel feeds and ensure that any residual references in logs or firewall rules are treated as malicious. Continuous monitoring of Cloudflare‑hosted IP ranges for similar impersonation attempts is recommended, as the infrastructure may be reused for future campaigns targeting cryptocurrency users.