trehzorwalet[.]webflow[.]io

The domain trehzorwalet.webflow.io has been identified as a high-risk brand impersonation infrastructure targeting Trezor hardware wallet users. Analysis indicates this resource was designed to mimic legitimate Trezor wallet interfaces, likely to harvest cryptocurrency credentials or distribute malicious software. The domain is currently offline, though its prior activity remains a documented threat. Infrastructure analysis reveals the domain was flagged by 14 of 95 security vendors on VirusTotal, with detection signatures spanning phishing and brand impersonation categories. The domain was registered through MarkMonitor Inc. on June 15, 2026, and resolved to the IP address 172.64.151.8. It appears on three security blocklists, including MetaMask and PhishDestroy, and was blocked by SEAL. The SSL certificate was issued by Google Trust Services, while the page title "Trezor^^ W𝗮llet* - The Most Advanced Hardware W𝗮llet" contained Unicode obfuscation to evade basic detection mechanisms. Current status confirms the domain has been taken offline, though similar infrastructure may reemerge under different identifiers. Organizations and users are advised to monitor for Unicode-based obfuscation in domain names and page titles, particularly those mimicking cryptocurrency hardware providers. Network defenders should update blocklists with the documented IP (172.64.151.8) and registrar patterns (MarkMonitor Inc.) associated with this campaign. Cryptocurrency users should verify domain authenticity through official channels before entering credentials or downloading software.