xn--suite-trz-3xb[.]webflow[.]io

This domain is an active phishing infrastructure impersonating Trezor, a cryptocurrency hardware wallet provider. The site presents itself as the official Trezor Suite application, using the page title "Trézōr Suite™ App® | Trezor Suite (Official) | #Trezor®" to deceive users into believing they are interacting with legitimate software. Such brand impersonation is commonly used to harvest cryptocurrency wallet credentials, seed phrases, or distribute malicious payloads under the guise of legitimate updates or authentication portals.

Analysis indicates the domain was registered on May 08, 2013, through MarkMonitor, Inc., though the phishing content appears to be a more recent development. The infrastructure resolves to IP address 104.18.36.248 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. Security vendors have flagged this domain, with 6 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on three security blocklists and is actively blocked by multiple cryptocurrency security tools, including MetaMask and SEAL.

Users who have visited xn--suite-trz-3xb.webflow.io should assume potential exposure of sensitive credentials or wallet information. Immediate steps include revoking any active sessions, resetting passwords, and scanning local devices for malware. Cryptocurrency users should verify wallet integrity and monitor transactions for unauthorized activity. All interactions with this domain should be treated as compromised, and any downloaded software or entered credentials must be considered at risk.