help-s-trezzor-auth-op[.]webflow[.]io

This domain, help-s-trezzor-auth-op.webflow.io, was observed hosting a page whose title reads “Trezor.io/Start® | Trezor Suite App (Official) | Trezor®”, indicating a clear attempt to impersonate the Trezor cryptocurrency hardware‑wallet brand. The site resolves to 104.18.36.248, an address owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. Cloudflare’s DNS resolvers are listed as journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the infrastructure is being delivered through Cloudflare’s edge network and that HTTP/3 is enabled. The TLS certificate presented is issued by Google Trust Services under the WE1 root, which is a legitimate public‑trusted chain, thereby providing a veneer of authenticity. The domain registration record shows the domain was created on May 08 2013 and is managed through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises for brand protection.

Despite the reputable registrar, the site has been taken offline and currently returns an HTTP 404 status. VirusTotal scans have flagged the domain in 13 of 95 security engines, and the domain appears on at least one public blocklist. PhishDestroy has also listed the domain as blocked. The observed scam type is classified as a crypto scam, consistent with the Trezor impersonation. Evidence indicates the malicious actor leveraged a legitimate web‑hosting platform (Webflow) and Cloudflare’s CDN to mask the origin of the content, a pattern frequently seen in brand‑impersonation campaigns.

The combination of a brand‑specific page title, a trusted SSL certificate, and a reputable registrar makes the domain more likely to bypass naïve user scrutiny and automated trust‑based filters. Uncertainties remain regarding the full payload or credential‑harvesting mechanisms, as the page content has not been captured and the site is currently offline.