trezoiaorwallet[.]webflow[.]io

This domain is currently under investigation for brand impersonation targeting Trezor, a hardware wallet provider. The threat type is classified as brand_impersonation, where malicious actors replicate official branding to deceive users into disclosing sensitive credentials or installing malicious software. Analysis indicates a risk level marked as under_investigation, reflecting the need for further scrutiny given the domain's active status and lack of prior detection flags. Infrastructure analysis reveals the domain trezoiaorwallet.webflow.io was registered through MarkMonitor, Inc., and resolves to the IP address 104.18.36.248. The domain was created on May 8, 2013, though its current malicious activity appears to be a recent development. VirusTotal reports 0 detections out of 95 security vendors, suggesting the domain has not yet been widely flagged. The SSL certificate is issued by Google Trust Services, which does not inherently indicate malicious intent but is often leveraged to lend credibility to fraudulent sites. No blocklist entries or trust score degradations were identified at the time of assessment, though the page title explicitly mimics Trezor's official onboarding URL, trezor.io/start. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address (104.18.36.248) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems to prevent user access. Users who may have interacted with the domain should be instructed to reset credentials for any accounts linked to Trezor services, particularly if they entered recovery seeds or private keys. Security teams are advised to monitor for outbound connections to the domain and IP, as well as any attempts to exfiltrate wallet-related data. Given the domain's active status, continuous monitoring for additional detection flags or changes in infrastructure is recommended.