trezor-io--trezor---model---t-uses[.]webflow[.]io

This domain, trezor-io--trezor---model---t-uses.webflow.io, is flagged as a high-risk brand impersonation resource targeting Trezor, a cryptocurrency hardware wallet manufacturer. Analysis indicates the page mimics the official Trezor Model T interface, presenting itself under the title 'Trezor Model T | The Most Advanced Hardware Wallet.' The threat type aligns with credential harvesting and cryptocurrency theft, likely designed to deceive users into entering recovery phrases or private keys under false pretenses. Infrastructure analysis reveals the domain was registered through Webflow on June 15, 2026, and resolves to the IP address 172.64.151.8. Detection metrics show 15 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms, including MetaMask and PhishDestroy. At present, the domain has been taken offline, reducing immediate exposure risk. However, the infrastructure remains registered, and similar campaigns may re-emerge under different subdomains or registrars. Users are advised to verify domain authenticity through official channels and treat unsolicited hardware wallet prompts with skepticism. Organizations should monitor for related indicators of compromise, including the IP 172.64.151.8 and Webflow-registered domains with similar naming patterns.