treexorsuiite[.]webflow[.]io

The domain treexorsuiite.webflow.io was identified as a brand impersonation threat specifically targeting Trezor, a well-known cryptocurrency hardware wallet company. This domain was designed to deceive users into believing they were accessing the legitimate Trezor Suite platform, likely to steal login credentials or cryptocurrency funds through a fake login interface. As of the latest intelligence, this domain has been taken offline, though its impact may have already affected unsuspecting users.

Technical analysis reveals that this domain was created on April 24, 2026, and registered through Webflow. It resolves to the IP address 172.64.151.8 and is associated with an SSL certificate issued by Google Trust Services / WE1. VirusTotal analysis shows that 18 out of 95 security vendors flagged this domain as malicious, indicating a high level of confidence in its threat status. Additionally, the domain appears on one security blocklist. The page title detected was "Trezor Suite - A new desktop and web - Webflow," which closely mimics the legitimate Trezor Suite branding to increase credibility among targets.

Given that the domain is now offline, the immediate risk of interaction is reduced, but users who may have encountered it previously should take precautions. PhishDestroy recommends that anyone who visited this domain or entered any personal or financial information should immediately change their credentials and enable two-factor authentication on affected accounts. It is also advised to monitor accounts for any unauthorized activity. For future reference, always verify the authenticity of cryptocurrency platforms by double-checking the URL and consulting trusted sources like PhishDestroy before entering sensitive information.