trezor-suite-app[.]webflow[.]io

This domain is assessed as a brand impersonation infrastructure node targeting the Trezor ecosystem. Analysis indicates it presents a counterfeit web interface designed to mimic official application onboarding flows, with the intent to harvest sensitive wallet credentials, recovery phrases, and authentication data. The domain is currently reported as offline, however historical telemetry indicates active phishing configuration and redirection behavior consistent with credential harvesting campaigns.

Technical indicators confirm malicious classification. VirusTotal reports 19/95 security vendors flagging the domain as malicious. The domain is registered through Webflow infrastructure and resolves to IP 172.64.151.8, hosted under Cloudflare, Inc. network space in CA. TLS configuration uses Google Trust Services / WE1 certificate. The domain appears on 3 independent security blocklists, reinforcing multi-source detection consensus.

If users interacted with this domain, immediate risk mitigation is required. Any entered seed phrases or private keys should be considered compromised, and affected wallet assets should be migrated to a newly generated secure wallet using a clean device. Users should revoke all active sessions and authorization tokens linked to the affected environment. Endpoint scanning for malware and browser credential extraction should be performed. Monitoring for unauthorized blockchain transactions is strongly advised, as delayed exploitation is common in credential theft incidents.