trzorrwallrt[.]webflow[.]io

The domain trzorrwallrt.webflow.io is identified as a brand impersonation threat targeting the cryptocurrency hardware wallet brand Trezor. The domain mimics the official Trezor website, potentially misleading users into believing they are interacting with a legitimate Trezor service. This impersonation can lead to various malicious activities, such as credential theft or financial fraud.

Infrastructure analysis reveals that trzorrwallrt.webflow.io has been flagged by 9 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion among security experts. The domain is registered through MarkMonitor, Inc., a well-known domain registrar often used by legitimate and high-profile entities. The IP address 104.18.36.248 is associated with this domain, and it was created on June 15, 2026. The domain is not currently listed in the Google Safe Browsing database but appears on 3 security blocklists, further suggesting its malicious nature. The SSL certificate is issued by Google Trust Services, which can provide a false sense of security to users.

The domain is currently offline, which mitigates the immediate risk of users falling victim to the impersonation. However, the infrastructure and creation date suggest that the threat actors may have plans to reactivate the domain. Security measures such as blocking by MetaMask, PhishDestroy, and SEAL have been implemented, reducing the likelihood of successful attacks. Despite these actions, the domain remains a potential threat, and users should remain vigilant and avoid interacting with any future versions of this site. Organizations and individuals are advised to monitor for similar domain registrations and implement additional security protocols to protect against brand impersonation attacks.