trezor-iostrrt[.]webflow[.]io

This domain, trezor-iostrrt.webflow.io, presents a high-risk brand impersonation threat designed to deceive users of the Trezor hardware wallet. The site displays a fraudulent setup page titled 'Trezor.io/Start | Trezor io Wallet,' which closely mimics the legitimate Trezor onboarding process. Visitors are likely prompted to enter sensitive wallet recovery phrases or private keys, enabling attackers to drain cryptocurrency funds from connected wallets. The page structure and visual elements are crafted to appear authentic, increasing the likelihood of successful deception. Analysis indicates this domain was created on June 15, 2026, and registered through MarkMonitor, Inc., a registrar commonly associated with legitimate corporate domains. The site resolves to the IP address 172.64.151.8 and is hosted on infrastructure provided by a well-known content delivery network, which may obscure its true origin. Security vendors have flagged this domain on VirusTotal, with 13 out of 95 engines detecting malicious activity. Additionally, the domain appears on three security blocklists and is actively blocked by multiple wallet security tools. The SSL certificate issued by Google Trust Services further lends a false sense of legitimacy to unsuspecting users. If you visited trezor-iostrrt.webflow.io and entered any sensitive information, such as a recovery seed or private key, immediate action is required. Disconnect the affected device from the internet to prevent further unauthorized access. Transfer any remaining funds from the compromised wallet to a new, secure wallet with a fresh recovery phrase. Monitor all connected accounts for unauthorized transactions and consider reporting the incident to relevant cryptocurrency abuse databases. Users should also verify the authenticity of any wallet-related communications by accessing official channels directly, rather than following links from emails or search results.