trezerwalletui[.]webflow[.]io

This domain is flagged as a high-risk crypto drainer, designed to siphon cryptocurrency assets from compromised wallets. Analysis indicates the site employs malicious scripts to intercept and redirect transactions, a common tactic in crypto drainer operations. The infrastructure is actively targeting users through deceptive wallet interfaces, likely impersonating legitimate services to trick victims into authorizing unauthorized transfers. Infrastructure analysis reveals the domain trezerwalletui.webflow.io resolves to IP address 104.18.36.248 and is hosted under an SSL certificate issued by Google Trust Services. The domain was registered on May 8, 2013, through MarkMonitor, Inc., though recent activity suggests malicious repurposing. Security vendor assessments on VirusTotal indicate 17 out of 95 engines detect the domain as malicious, with specific classifications aligning to crypto drainer behaviors. No widespread blocklist inclusion is observed at this time, though the domain remains active and operational. Mitigation requires immediate action from both end users and network defenders. Users should revoke any wallet authorizations granted to trezerwalletui.webflow.io via connected application settings in their wallet software. Network-level protections should include DNS sinkholing for the domain and IP, as well as blocking outbound connections to 104.18.36.248. Security teams should monitor for transaction requests originating from this domain and investigate any wallet interactions tied to it. Given the high-risk nature of crypto drainers, affected users should transfer remaining funds to a new wallet address and audit all connected applications for unauthorized access.