content-staking-cdnn[.]webflow[.]io

This domain, content-staking-cdnn.webflow.io, is identified as an active high-risk phishing resource specializing in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The site presents itself as a legitimate staking platform for Ethereum (ETH) under the false pretense of official Trezor services, using the page title 'Trezor staking® | Staking Ethereum (ETH) on TreZor.' Analysis indicates the presence of a cryptocurrency drainer mechanism, designed to siphon digital assets from unsuspecting users by mimicking trusted interfaces and transaction prompts.

Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 104.18.36.248 and is hosted on a platform utilizing SSL certificates issued by Google Trust Services. It was initially registered through MarkMonitor, Inc. on May 8, 2013, though the specific phishing subdomain appears to be a more recent creation. Detection metrics show a VirusTotal score of 3/95, with three security vendors flagging the domain as malicious. Additionally, the domain appears on three distinct security blocklists and is actively blocked by multiple threat intelligence feeds, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification.

As of the latest assessment, content-staking-cdnn.webflow.io remains operational, indicating an ongoing threat. Response actions by security entities have included widespread blocking and blacklisting; however, the domain continues to resolve and may still pose a risk to users unaware of its fraudulent nature. Organizations and individuals are advised to implement network-level blocking for the domain and IP address, deploy endpoint protection measures, and conduct user awareness training to mitigate the risk of asset compromise. Continuous monitoring of related subdomains and infrastructure reuse patterns is recommended to preempt further abuse.