trezoerwalleit[.]webflow[.]io

The domain trezoerwalleit.webflow.io is currently under investigation for brand impersonation targeting Trezor, a hardware wallet provider. Analysis indicates the site presents itself as an official Trezor Wallet interface, with the page title "Trezor Wallet - The Secure Hardware Wallet," suggesting an attempt to deceive users into believing it is a legitimate platform for cryptocurrency storage or transactions. The domain remains active as of the latest assessment, with no takedown or mitigation measures observed. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 104.18.36.248 and is hosted on infrastructure associated with Google Trust Services, as evidenced by its SSL certificate. The domain was originally created on May 08, 2013, though this date may reflect the registration of the parent domain rather than this specific subdomain. No detections were reported by any of the 95 vendors aggregated on VirusTotal, indicating the domain has not yet been flagged by automated security tools. Registration details point to MarkMonitor, Inc. as the registrar, a provider commonly used for both legitimate and malicious domains. The risk posed by this domain is currently classified as under investigation due to the absence of confirmed malicious activity in public threat feeds. However, the combination of brand impersonation, active status, and unflagged infrastructure warrants caution. Users are advised to avoid interacting with the domain, particularly for cryptocurrency-related activities. Organizations should monitor for further indicators of compromise, such as unexpected redirects or credential harvesting attempts originating from this domain. Blocklisting at the network level is recommended as a precautionary measure until additional evidence confirms or refutes malicious intent.