trezorswalletin[.]webflow[.]io

Analysis as of July 29, 2026 classifies trezorswalletin.webflow.io as an active crypto‑drainer infrastructure with a high risk rating. The domain is hosted on Webflow, a well‑known website‑building platform, and resolves to the IP address 172.64.151.8, which is associated with a shared hosting environment typical of content‑delivery networks. No authoritative nameserver records were returned (NS_NOT_FOUND), indicating that standard DNS queries do not reveal a conventional nameserver configuration. VirusTotal reports that 16 of 91 security vendors have flagged the domain, providing independent corroboration of malicious intent.

The domain is presently listed on three external security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting that both general phishing‑filtering services and cryptocurrency‑wallet protection tools recognize it as hostile. The available evidence does not include a page title, SSL certificate details, HTTP response codes, or safe‑browsing verdicts, so those vectors remain unverified. Defenders should treat any traffic to or from trezorswalletin.webflow.io as suspicious. Network‑level controls ought to block the IP 172.64.151.8 and any associated CIDR ranges.

Endpoint protection solutions should incorporate the domain into block lists and monitor for attempts to resolve or contact the host. Users of cryptocurrency wallets should be warned that connections to this domain are likely to attempt unauthorized fund transfers. Continuous monitoring for changes in DNS resolution, additional blocklist listings, or new vendor detections is recommended to maintain situational awareness.