trzor-hrdwre-walet[.]webflow[.]io

This domain, trzor-hrdwre-walet.webflow.io, is identified as a high-risk brand impersonation asset targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to mimic the official Trezor onboarding process, as evidenced by the page title "Trezor@* Hardware® Wallet® | Getting Started with Trezor©." The intent appears to be credential theft or the distribution of malicious payloads under the guise of legitimate wallet initialization procedures. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with known impersonation tactics used to harvest sensitive user data. Infrastructure analysis reveals the domain was registered on May 08, 2013, through MarkMonitor Inc., though the malicious activity likely represents a recent compromise or repurposing of the domain. It resolves to the IP address 172.64.151.8 and is secured with an SSL certificate issued by Google Trust Services. The domain is flagged by 13 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists. Detection systems such as MetaMask, PhishDestroy, and SEAL have already classified this domain as malicious, further corroborating its fraudulent nature. As of the latest assessment, trzor-hrdwre-walet.webflow.io has been taken offline, reducing immediate exposure risk. However, the domain remains registered and could be reactivated or repurposed for future campaigns. Users who interacted with the domain prior to its takedown should assume potential compromise of credentials or installation of unauthorized software. Affected parties are advised to revoke any associated wallet permissions, rotate passwords, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its resolving IP to prevent future access attempts.