trerznriostart[.]webflow[.]io

Analysis of trerznriostart.webflow.io shows a high‑risk brand‑impersonation campaign targeting the Trezor hardware‑wallet brand. The domain was created on May 08, 2013 and is hosted behind Cloudflare, resolving to IP address 104.18.36.248, which is registered to AS13335 in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS connection despite the malicious intent. DNS resolution uses Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com.

An HTTP request returned a 404 status, suggesting that the malicious page has been taken offline, which aligns with the current offline status reported. The page title captured from the site, "Trezor.io/start - Trezor Hardware Wallet (Official) - webflow," directly references the legitimate Trezor brand, confirming the impersonation motive. VirusTotal scans recorded 12 detections out of 91 security vendors, providing concrete evidence of malicious classification. The domain is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that the site is hostile.

Registration was performed through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may indicate either a compromised account or abuse of a legitimate‑looking registration channel. Given the combination of a valid SSL certificate, Cloudflare infrastructure, brand‑specific page title, multiple vendor detections, and active blocklist listings, defenders should treat trerznriostart.webflow.io as a confirmed malicious actor. Recommended actions include adding the domain to network and email blocklists, monitoring for any resurgence of content, and informing users to avoid any URLs containing the "trezor.io/start" pattern that are hosted on non‑official domains. Continuous vigilance is advised, as the underlying Cloudflare IP could be reused for future impersonation attempts.