trezzeroiosart[.]webflow[.]io

The domain trezzeroiosart.webflow.io is identified as a high-risk brand impersonation threat specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. Analysis indicates this domain hosted a fraudulent setup page titled 'Trezor.io/Start - Trezor Hardware Wallet (Official)', designed to deceive users into believing they were accessing the legitimate Trezor onboarding process. This form of brand impersonation is commonly used to harvest sensitive credentials, seed phrases, or deploy crypto-draining malware onto victim devices.

Infrastructure analysis reveals multiple high-confidence threat indicators. The domain is flagged by 11 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It resolves to the IP address 172.64.151.8 and is registered through MarkMonitor Inc., a registrar frequently associated with both legitimate and abusive domains. The domain was created on June 15, 2026, suggesting either a typo-squatting attempt or an anomalous registration date, as this predates the current date. Additionally, the domain appears on three independent security blocklists and is actively blocked by at least three major security providers, including MetaMask and PhishDestroy. The SSL certificate is issued by Google Trust Services, which, while not inherently malicious, is commonly leveraged by threat actors to lend a false sense of legitimacy to phishing infrastructure.

As of the latest assessment, trezzeroiosart.webflow.io has been taken offline, reducing immediate risk to end users. However, the underlying infrastructure and registration details remain a concern. Users who may have interacted with this domain are advised to immediately revoke any associated wallet permissions, rotate all cryptographic credentials, and scan their devices for malware. Organizations should update internal blocklists to include this domain and its resolved IP address, and monitor for any re-emergence or related domains using similar naming conventions. Proactive threat hunting is recommended to identify any lateral movement or persistence mechanisms that may have been established during the period of active compromise.