trezorwalletibq[.]webflow[.]io

This domain, trezorwalletibq.webflow.io, is flagged as a high-risk brand impersonation resource targeting Trezor, a well-known hardware cryptocurrency wallet provider. Analysis indicates the site mimics the official Trezor interface, presenting itself as the legitimate "Trezor Wallet | Hardware Wallet (Official) | Bitcoin & Crypto" portal. The threat type is classified as brand impersonation, likely intended to deceive users into disclosing sensitive credentials or interacting with malicious smart contracts, though no direct crypto drainer kit signatures have been confirmed at this stage. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 172.64.151.8 and was originally created on May 8, 2013, though the subdomain appears to have been repurposed for malicious activity. The domain is registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and abused infrastructure. Detection metrics show 6 out of 95 security vendors on VirusTotal flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while obfuscating the underlying threat. No Google Safe Browsing (GSB) blocklist entries were identified at the time of analysis, though this may reflect a lag in propagation rather than absence of risk. As of the latest assessment, trezorwalletibq.webflow.io remains active and accessible, posing an ongoing threat to unsuspecting users. No takedown actions have been observed, and the domain continues to resolve without interruption. Users are advised to exercise extreme caution, verify domain authenticity through official channels, and avoid interacting with any unsolicited prompts or forms. Organizations should consider preemptive blocklisting of the domain and IP to mitigate exposure, while monitoring for related infrastructure that may emerge in subsequent campaigns.