trezo-bridg-app[.]webflow[.]io

The domain trezo-bridg-app.webflow.io is currently active and has been identified as a high‑risk generic phishing infrastructure. Analysis shows that the domain resolves to the IP address 172.64.151.8, which is hosted by the Webflow platform. The registration record lists Webflow, Inc. as the registrar, indicating that the site is likely using Webflow’s SaaS hosting service. The domain appears on a single security blocklist and is also listed by the PhishDestroy blocklist, confirming that at least one external threat‑intelligence feed has taken mitigation action against it.

VirusTotal reports that 10 of 91 security vendors have flagged the domain as malicious, providing additional independent corroboration of its malicious nature. No publicly available nameserver information could be retrieved (NS_NOT_FOUND), and no SSL certificate details, HTTP status codes, or page‑title metadata have been disclosed, leaving those vectors unverified at this time. The absence of further telemetry such as Safe Browsing, OTX, or additional blocklist entries suggests that the infrastructure may be relatively new or limited in scope, but the existing detections are sufficient to classify the domain as high risk.

Defenders should add trezo-bridg-app.webflow.io to URL filtering rules, block the associated IP 172.64.151.8 at network perimeter devices, and monitor for any traffic to Webflow‑hosted subdomains that exhibit similar detection patterns. Continuous re‑scanning with VirusTotal and other multi‑engine scanners is advised to capture any changes in vendor verdicts. Organizations using Webflow‑based services should verify that legitimate use cases are whitelisted to avoid false positives while maintaining the block on this specific subdomain.