trezorikewallet[.]webflow[.]io

This domain, trezorikewallet.webflow.io, is an active phishing infrastructure designed for brand impersonation, specifically targeting Trezor, a well-known hardware wallet provider for cryptocurrency storage. The site presents itself as an official Trezor Wallet platform, aiming to deceive users into disclosing sensitive credentials or transferring digital assets to attacker-controlled addresses. Analysis confirms the domain remains operational as of the latest verification. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. on May 08, 2013, though the phishing content appears to be a recent deployment. It resolves to the IP address 172.64.151.8 and is flagged by 7 of 95 security vendors on VirusTotal. The domain appears on three distinct security blocklists and has been proactively blocked by multiple threat intelligence platforms. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Gridinsoft assigns the domain a trust score of 0 out of 100, further corroborating its malicious nature. The domain remains active and continues to pose a significant risk to cryptocurrency users. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users should verify the authenticity of any Trezor-related website by cross-referencing official communications from the legitimate Trezor domain. Security teams are encouraged to monitor for additional subdomains or related infrastructure that may emerge under the same hosting provider. Immediate reporting to relevant security communities is recommended to facilitate broader takedown efforts.