trrezoorwallett[.]webflow[.]io

Analysis of trrezoorwallett.webflow.io indicates a brand‑impersonation campaign targeting users of the Trezor hardware wallet. The domain was registered on March 22 2026 through the Webflow platform and resolves to the Cloudflare edge address 104.18.36.248, which is geolocated to California, United States. The site delivers an HTTP/3 response and presents a valid SSL certificate issued by Google Trust Services, suggesting a legitimate TLS termination that can bypass naïve certificate checks. The page title retrieved from the server is “Securing Your Cryptos with Trezor Hardware Wallet”, directly referencing the Trezor brand and aligning with the declared crypto‑scam classification. An HTTP 404 status is returned, and the domain is currently taken offline, which limits immediate interaction but does not remove the underlying infrastructure.

Detection evidence shows the domain appears on one external blocklist and has been flagged by the PhishDestroy sinkhole, confirming that at least one security‑focused organization has observed malicious activity. VirusTotal scans have resulted in 16 of 94 security vendors labeling the domain as malicious, reinforcing the suspicion of abuse. No additional public threat‑intelligence sources (e.g., OTX, Safe Browsing) are documented in the available data. Uncertainty remains around the exact payload or phishing page content, as no visual or form analysis is available.

The short lifespan and the use of a shared Webflow hosting environment suggest the operators may rely on rapid deployment and takedown to avoid detection. Defenders should add the domain and its resolving IP address to outbound deny lists, monitor for any future re‑registration of similar Webflow subdomains, and ensure that endpoint security solutions incorporate the VirusTotal detection count. Email gateways and web‑proxy filters should be updated to block references to the page title phrase and to the Trezor brand when paired with the suspicious Webflow host.