auth-support-trzorwallet[.]webflow[.]io

The domain auth-support-trzorwallet.webflow.io is currently active and engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates this is not a generic phishing attempt but a deliberate effort to deceive users into believing they are interacting with official Trezor infrastructure. The domain presents itself as an official wallet portal, increasing the likelihood of credential theft or crypto asset compromise. Infrastructure analysis reveals the domain resolves to the IP address 172.64.151.8 and was registered through MarkMonitor, Inc. Despite its creation date of May 08, 2013, the domain is being actively misused, as evidenced by its detection by 5 of 95 security vendors on VirusTotal. The page title, 'Trezor @Wallet* - The official wallet - Webflow,' further confirms the intent to impersonate Trezor’s branding. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. As of the latest assessment, the domain remains active and unblocked by most security platforms. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to prevent access. Users should verify all interactions with Trezor through official channels only, such as the verified website trezor.io, and report any suspicious activity to their security teams. Monitoring for similar domains using the seed 'eb7c89' in threat intelligence feeds is recommended for proactive defense.