trezhardwwalle[.]webflow[.]io

The domain trezhardwwalle.webflow.io has been identified as a high-risk brand impersonation threat targeting Trezor, a well-known cryptocurrency hardware wallet provider. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent page titled 'Trezor Hardware Wallet (Official) | Bitcoin & Crypto Security,' designed to deceive users into believing it was the legitimate Trezor platform. Infrastructure analysis reveals the domain was flagged by 10 of 95 security vendors on VirusTotal, indicating widespread detection. It resolves to the IP address 104.18.36.248 and is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate domains but occasionally exploited for malicious purposes. The domain was created on June 15, 2026, and appears on three security blocklists. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Detection by multiple security entities, including MetaMask and PhishDestroy, further corroborates its malicious intent. Given its current offline status, the domain may resurface under a different configuration or alias. Users are advised to verify all cryptocurrency-related domains through official channels and avoid interacting with any site claiming to represent Trezor unless confirmed via the organization’s verified communication platforms. Security teams should monitor for similar impersonation attempts and update blocklists to include this domain and its associated indicators of compromise, such as the IP address 104.18.36.248 and the registrar details.