tresswallet[.]webflow[.]io

This domain, tresswallet.webflow.io, operates as a crypto drainer, a specialized form of phishing infrastructure designed to exploit wallet connections on decentralized platforms. Analysis indicates the domain deploys malicious JavaScript to intercept and drain cryptocurrency assets from connected wallets, typically by tricking users into signing transactions that transfer funds to attacker-controlled addresses. The threat is particularly severe due to its direct financial impact, often resulting in irreversible asset loss for victims. Evidence supporting this assessment includes detection by 17 out of 95 security vendors on VirusTotal, indicating a broad consensus on its malicious nature. The domain was registered through MarkMonitor, Inc. on May 08, 2013, though its current malicious use suggests compromise or repurposing of existing infrastructure. It appears on four independent security blocklists, including those maintained by wallet security providers and domain reputation services. The domain resolves to the IP address 104.18.36.248, a Cloudflare-associated address, which is commonly used to obfuscate the true origin of malicious traffic. Users who interacted with tresswallet.webflow.io should immediately revoke any wallet connections or permissions granted to the domain. All active sessions should be terminated, and any transactions signed during the interaction period should be reviewed for unauthorized transfers. It is recommended to transfer remaining assets to a new wallet address and monitor connected accounts for suspicious activity. If credentials or recovery phrases were entered, assume full compromise and initiate account recovery procedures with the respective wallet provider. No further interaction with the domain should occur, even if it appears inactive, as it may reactivate or redirect to other malicious endpoints.