treezoarwalletis[.]webflow[.]io

This domain, treezoarwalletis.webflow.io, is flagged as an active brand impersonation threat targeting Trezor, a hardware cryptocurrency wallet provider. The site presents itself as the official Trezor wallet interface, using the page title 'Trezor @Wallet* - The official wallet' to deceive users into disclosing sensitive credentials or installing malicious software. Analysis indicates this is a high-risk threat due to its deceptive branding and confirmed malicious activity. Infrastructure analysis reveals the domain was registered on May 08, 2013, through MarkMonitor, Inc., and currently resolves to the IP address 172.64.151.8. It is flagged by 19 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on three security blocklists and is actively blocked by multiple threat detection systems, including MetaMask, PhishDestroy, and SEAL. The site employs Cloudflare for hosting and uses Google Trust Services for its SSL certificate, leveraging HTTP/3 for communication. Current status confirms the domain remains active and operational. Organizations and users are advised to block the domain and its associated IP address (172.64.151.8) at the network level. Security teams should update endpoint protection rules to include this domain in phishing and brand impersonation filters. Users who may have interacted with the site should immediately revoke any credentials or session tokens associated with cryptocurrency wallets and conduct a security review of connected devices. Monitoring for unauthorized transactions or access attempts is strongly recommended.