m-app--start-trezor[.]webflow[.]io

This domain, m-app--start-trezor.webflow.io, is flagged as a brand_impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The domain is currently offline, but prior analysis indicates malicious intent to deceive users into believing they are accessing legitimate Trezor services, specifically the device setup process. Analysis indicates the domain was registered on February 22, 2026, through NameCheap, Inc. It resolved to the IP address 104.18.36.248, hosted on infrastructure belonging to Cloudflare, Inc. (AS13335) in the United States. The domain appears on one security blocklist and was flagged by 20 of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services (WE1), and the page title mimicked the legitimate Trezor setup page with the text "Trezor.io/Start® | Starting Up Your Device |Trezor®". The domain was blocked by PhishDestroy prior to being taken offline. The current status of m-app--start-trezor.webflow.io is offline, but the infrastructure and registration details remain relevant for historical threat analysis. Organizations and users are advised to monitor for similar domains leveraging the Trezor brand, particularly those using webflow.io subdomains or NameCheap registrations. Network defenders should update blocklists to include this domain and its associated IP address. Users who may have interacted with this domain should verify their device integrity and review account activity for unauthorized access.