trozzxstowallet[.]webflow[.]io

Analysis of the domain trozzxstowallet.webflow.io indicates confirmed phishing infrastructure targeting Trezor, a hardware wallet provider. The domain, hosted on Cloudflare infrastructure (IP 172.64.151.8, AS13335), was flagged by 13 of 95 security vendors on VirusTotal and appears on the PhishDestroy blocklist. The SSL certificate is issued by Google Trust Services (WE1), and the domain resolves to nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The page title, 'Trezor Wallet - The #1 Secure Hardware Wallet,' directly impersonates Trezor's branding, aligning with the scam type classified as a crypto scam in available intelligence.

The domain was registered through MarkMonitor, Inc. on May 8, 2013, though this creation date may reflect the registration of the parent Webflow.io subdomain rather than the specific phishing subdomain. Current HTTP status returns a 404, suggesting the site has been taken offline, though historical activity cannot be ruled out. Technologies detected include Cloudflare and HTTP/3, common for both legitimate and malicious infrastructure due to their performance and security features. Defenders should treat this domain as high-risk for Trezor users, particularly those who may have interacted with it prior to its takedown.

While no active content is currently served, the domain's historical use for brand impersonation and its presence on security blocklists warrant continued monitoring. Organizations should ensure endpoint protection and email filtering systems block access to this domain and related IPs. Further investigation into associated infrastructure, such as other subdomains or linked IPs, may uncover additional threats. The exact content of the phishing page is not analyzed, but the combination of brand impersonation, crypto scam classification, and security vendor detections provides sufficient evidence for mitigation actions.