learn-trezorwallt[.]webflow[.]io

Analysis of learn-trezorwallt.webflow.io identifies a high-risk brand impersonation attempt targeting Trezor. The domain structure mimics legitimate hardware wallet onboarding patterns, suggesting intent to mislead users into credential or wallet-related interaction. The hosting on a webflow.io subdomain indicates use of a low-cost rapid deployment platform, commonly abused for short-lived malicious pages. No active content is currently visible, and the endpoint returns a 404 page, consistent with removal or takedown actions.

Technical indicators show VirusTotal scoring of 17/95 security vendors flagging the domain. The domain was registered through NameCheap, Inc. on February 21, 2026. It resolves to IP 172.64.151.8, operated within AS13335 Cloudflare, Inc., indicating reverse proxy infrastructure. SSL certificate is issued by Google Trust Services / WE1. The domain appears on 3 security blocklists, reinforcing malicious classification.

Current status indicates the domain is offline, with observed 404 responses suggesting content removal or suspension. Despite takedown, historical telemetry and prior detections confirm it was used for brand impersonation of Trezor. Residual risk remains due to potential reactivation on similar infrastructure or reuse of subdomain patterns. Users should treat any resurrected variant or lookalike domains as high risk, particularly those mimicking wallet login flows or seed phrase prompts. Defensive actions include continued monitoring of related subdomains, blocking resolution at DNS/SOC level, and correlation with phishing intelligence feeds.