trezorawlalet[.]webflow[.]io

The domain trezorawlalet.webflow.io impersonates the cryptocurrency wallet brand Trezor, aiming to deceive users into divulging sensitive information. Although the site is currently offline, it has been flagged by 6 out of 91 vendors on VirusTotal, indicating its malicious nature. Additionally, it appears on public blocklists from PhishDestroy, MetaMask, and SEAL.

Registered through MarkMonitor, Inc., the domain was hosted on an IP address managed by Cloudflare, Inc. in the United States. The SSL certificate was issued by Google Trust Services, adding a layer of perceived legitimacy to the site. Despite its creation date in 2013, the domain was first detected as a threat by PhishDestroy on June 20, 2026, showcasing its recent malicious activity.

The platform risk score for this domain is 75 out of 100, highlighting its potential danger to users. The impersonation of a well-known brand like Trezor suggests that the attackers aim to exploit the trust users have in the brand to steal sensitive information. Such phishing domains often operate in the critical window before antivirus databases are updated, making early detection crucial.

While the domain is now offline, its previous activity underscores the importance of staying informed about ongoing threats. The combination of a high platform risk score and multiple blocklist appearances indicates that this domain posed a significant threat during its active period. PhishDestroy's detection pipeline plays a vital role in identifying these threats before they can cause widespread harm.