terezoorwallet[.]webflow[.]io

Analysis of the domain terezoorwallet.webflow.io confirms it as a high-risk site engaged in brand impersonation targeting the Trezor brand. The domain does not appear to be utilizing any known drainer kits, but it is actively impersonating the official Trezor wallet, which can lead to significant financial and personal data theft.

Technical indicators reveal that the domain is flagged by 4 out of 95 security vendors on VirusTotal, indicating potential malicious activity. The domain is registered through MarkMonitor, Inc., and resolves to the IP address 104.18.36.248. It was created on May 08, 2013, and is currently using an SSL certificate from Google Trust Services. The domain is not listed in the Google Safe Browsing (GSB) database, and there are no known blocklist entries, which may suggest that the site is relatively new or has not yet been widely reported.

The current status of terezoorwallet.webflow.io is active, and it continues to pose a significant threat to users who may be misled into believing it is an official Trezor service. Immediate response actions should include reporting the domain to Trezor's security team and relevant authorities, as well as updating security advisories to warn potential victims. Despite the low number of security vendor flags, the remaining risk is high, and users should be advised to avoid interacting with this domain to prevent financial loss and data compromise.