tredzorrwaglet[.]webflow[.]io

This domain is flagged as a high-risk brand impersonation site targeting users of Trezor hardware wallets. The site presents itself as an official Trezor @Wallet interface, attempting to deceive visitors into entering sensitive credentials, recovery phrases, or private keys. Such impersonation attacks are commonly used to drain cryptocurrency wallets or gain unauthorized access to user funds, posing a severe financial risk to victims. Analysis indicates the domain was created on May 8, 2013, and is registered through MarkMonitor Inc., a registrar commonly used for both legitimate and malicious domains. Infrastructure review shows it resolves to IP address 172.64.151.8 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy. Despite its long registration history, only 2 out of 95 security vendors on VirusTotal currently flag this domain as malicious, suggesting either recent activation of malicious activity or evasion techniques to avoid detection. If you visited tredzorrwaglet.webflow.io and entered any sensitive information, immediately disconnect the affected device from the internet to prevent data exfiltration. Revoke any active sessions or authorizations linked to the compromised credentials. Reset your Trezor wallet using a secure, offline device and generate a new recovery seed. Monitor all associated accounts for unauthorized transactions and report the incident to the official Trezor support team for further mitigation steps. Do not reuse passwords or recovery phrases from the compromised session.