ss-start-ttrzor-com[.]webflow[.]io

The domain ss-start-ttrzor-com.webflow.io is flagged as an active brand impersonation phishing site. Analysis indicates this infrastructure specifically targets Trezor, a hardware cryptocurrency wallet provider, by mimicking its official setup portal. The page title, 'Trezor.io/Start® - Start Up Your Device | Trezor®,' directly replicates the legitimate onboarding process, increasing the likelihood of successful credential or seed phrase harvesting from unsuspecting users. Infrastructure analysis reveals the domain was created on May 08, 2013, though the phishing content appears to have been deployed recently. It is currently flagged by 2 of 95 security vendors on VirusTotal, suggesting limited detection coverage. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 172.64.151.8. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to the fraudulent page. No additional blocklist entries or trust score deviations were observed at the time of analysis. This phishing infrastructure remains active and poses a high risk to Trezor users attempting to initialize their devices. Security teams are advised to add ss-start-ttrzor-com.webflow.io and its resolving IP to blocklists immediately. Users should verify domain authenticity by cross-referencing with Trezor’s official documentation and avoid entering sensitive information on any untrusted portal. Organizations should monitor for similar subdomain patterns under webflow.io or other hosting providers, as this tactic is frequently reused for brand impersonation campaigns.