trezlletzeriyresi[.]webflow[.]io

PhishDestroy identifies trezlletzeriyresi.webflow.io as an active crypto drainer impersonating Trezor Wallet, posing a high risk to cryptocurrency users seeking secure storage solutions. This domain mimics the legitimate Trezor Wallet branding to deceive visitors into connecting wallets to fraudulent smart contracts designed to siphon cryptocurrency assets. The campaign leverages social engineering tactics, exploiting trust in well-known hardware wallet brands to trick users into authorizing malicious transactions.

This domain was flagged with a Risk Level: HIGH, SSL certificate issued by Google Trust Services, 16 out of 95 VirusTotal security vendors detecting malicious activity, resolves to IP 172.64.151.8, and displays a page title identical to the legitimate Trezor Wallet branding: 'Trezor @Wallet | Bitcoin & Crypto Security'. The domain is hosted on Webflow’s infrastructure, a legitimate platform often abused for phishing due to its ease of deployment and trustworthiness of associated domains. While specific creation date and registrar details are not provided, the domain remains active and continues to evade blocklists despite multiple detections, indicating ongoing evasion tactics.

Immediate mitigation steps include blocking the domain trezlletzeriyresi.webflow.io at the network and DNS levels to prevent user access. Users should verify any Trezor-related communications by navigating directly to the official Trezor website (trezor.io) via a trusted bookmark or search engine, never through embedded links. Enable hardware wallet transaction confirmation features and review transaction details meticulously before authorizing. Report the domain to security teams, browser vendors, and platforms like Google Safe Browsing or PhishDestroy to accelerate takedown. Educate cryptocurrency users to recognize red flags such as misspelled domains, urgency in requests, and unsolicited wallet connection prompts.