trewaixxllc[.]webflow[.]io

The domain trewaixxllc.webflow.io has been identified as a brand impersonation threat, specifically targeting Trezor. This domain was designed to deceive users by mimicking the official Trezor website, as evidenced by its page title, "Trezor $ Wallet - (Official* Website) - Webflow." The domain is classified as an elevated risk due to its malicious intent to impersonate a trusted brand, potentially leading to credential theft or financial loss for unsuspecting users.

Technical indicators further substantiate the threat posed by this domain. It has been flagged by 9 out of 95 security vendors on VirusTotal, indicating a significant level of detection across various security platforms. The domain was registered through MarkMonitor Inc. and resolves to the IP address 172.64.151.8. Despite the creation date being listed as June 15, 2026, which appears to be an error likely due to data entry or system misconfiguration, the domain's malicious nature is corroborated by its inclusion on three security blocklists, including those maintained by MetaMask, PhishDestroy, and SEAL. Furthermore, the SSL certificate is issued by Google Trust Services, adding a layer of authenticity that may deceive users.

Currently, the domain trewaixxllc.webflow.io is offline, reducing its immediate threat. However, the presence of this domain on multiple blocklists and its detection by multiple security vendors highlight the persistent risk of similar impersonation attempts. Users are advised to remain vigilant and verify the authenticity of websites before inputting sensitive information. Organizations should continue to monitor for such threats and educate users about recognizing and avoiding potential phishing sites. The takedown of this domain is a positive step, but the potential for future impersonation attempts warrants ongoing scrutiny and preventive measures.