trzriostrt-net[.]webflow[.]io

The domain trzriostrt-net.webflow.io is flagged as a generic_phishing site impersonating Trézor, a well-known hardware wallet brand. The site attempts to deceive users into believing it is the official Trézor wallet setup and initialization page, which could lead to the theft of sensitive information such as private keys and login credentials.

Analysis indicates that the domain has been flagged by 15 out of 95 security vendors on VirusTotal, suggesting a significant level of suspicion. The domain was created on May 08, 2013, and is registered through MarkMonitor, Inc. The IP address 172.64.151.8, associated with AS13335 Cloudflare, Inc., is located in the United States. The SSL certificate is issued by Google Trust Services / WE1, which may add a layer of credibility to the fraudulent site. The domain appears on one security blocklist and is currently still active according to known intelligence.

The domain remains active, and no immediate response actions have been reported to neutralize the threat. Given the high risk level and the potential for significant financial loss, users are advised to avoid interacting with trzriostrt-net.webflow.io. Security teams should monitor for any further activity and consider additional measures such as DNS blocking and user education to mitigate the risk.