trezzorwallettus[.]webflow[.]io

This domain, trezzorwallettus.webflow.io, is confirmed as a brand impersonation phishing site targeting Trezor, a manufacturer of cryptocurrency hardware wallets. The infrastructure is currently active and poses a high-risk threat to users by mimicking legitimate Trezor interfaces to harvest credentials, recovery seeds, or private keys. Analysis indicates the domain is specifically designed to deceive users into believing they are interacting with official Trezor services, potentially leading to unauthorized access to cryptocurrency wallets and financial loss. Infrastructure analysis reveals the domain was created on May 8, 2013, though the phishing content appears to be a more recent deployment. It is flagged by 6 of 95 security vendors on VirusTotal, indicating detection by a subset of the security community. The domain resolves to IP address 172.64.151.8 and uses an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. The registrar is MarkMonitor, Inc., a provider commonly used for both legitimate and malicious domains. The page title, 'Trezor wallet | Trezor Hardware Wallet,' directly mirrors official branding, further enhancing its deceptive capabilities. The domain remains active as of this report, and users are advised to treat it as malicious. Immediate actions include blocking the domain and IP address at the network level, updating endpoint protection rules to flag the domain as malicious, and alerting users to avoid interaction. Cryptocurrency wallet holders should verify the authenticity of any Trezor-related site by cross-referencing with official Trezor communication channels. Organizations are encouraged to monitor for connections to 172.64.151.8 and review logs for potential compromise indicators. Given the high-risk nature of this threat, proactive measures such as user education on phishing tactics and multi-factor authentication for wallet access are strongly recommended.