trzorwllete[.]webflow[.]io

This domain, trzorwllete.webflow.io, is flagged for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site presents itself as 'Trezor @Wallet* - The official wallet,' a deceptive page title designed to mislead users into believing they are interacting with legitimate Trezor infrastructure. No drainer kit signatures have been identified in initial scans, though further behavioral analysis is required to confirm the absence of automated credential harvesting scripts. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.64.151.8, a Cloudflare-assigned endpoint commonly used for content delivery and proxy services. VirusTotal reports 0 detections out of 95 engines, suggesting the domain has not yet been widely flagged by security vendors. The domain was originally created on May 8, 2013, though the subdomain trzorwllete.webflow.io appears to be a more recent deployment under Webflow’s hosting platform. The SSL certificate is issued by Google Trust Services, providing HTTPS encryption that enhances the appearance of legitimacy. Registrar details point to MarkMonitor Inc., though this reflects the parent domain’s registration rather than the subdomain’s malicious use. No entries in Google Safe Browsing or other blocklists were identified at the time of analysis. Current status remains active, with no takedown or mitigation actions observed. The domain continues to resolve and serve content, posing an ongoing risk to users who may mistake it for the official Trezor wallet interface. The lack of detections on VirusTotal and blocklists indicates a potential gap in automated detection, likely due to the use of a legitimate hosting provider and valid SSL certificate. Users are advised to verify domain authenticity by cross-referencing with official Trezor communication channels and avoid entering sensitive information on unverified platforms. Further monitoring is recommended to track changes in detection status or infrastructure modifications.