trezorawalilt[.]webflow[.]io

This domain, trezorawalilt.webflow.io, poses a direct threat as a brand_impersonation phishing site targeting users of Trezor hardware wallets. The site mimics the official Trezor interface, presenting itself as "Trezor @Wallet* - The official wallet webflow" to deceive victims into entering sensitive credentials, recovery seeds, or private keys. Such impersonation attacks are commonly used to drain cryptocurrency wallets or compromise associated accounts, making this a critical vector for financial theft and unauthorized access to digital assets.

Analysis indicates the domain was registered on March 29, 2026, through Webflow, a platform frequently abused for hosting phishing infrastructure due to its ease of deployment and SSL certificate provisioning. The domain is flagged by 18 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. It resolves to the IP address 104.18.36.248, which is associated with Cloudflare, Inc. in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging legitimate certificate authorities to appear trustworthy.

Users who visited trezorawalilt.webflow.io should immediately revoke any entered credentials or recovery seeds, as these are likely compromised. It is recommended to disconnect any connected wallets, monitor accounts for unauthorized transactions, and initiate a full security review of associated devices. If cryptocurrency was transferred or sensitive data was disclosed, affected parties should report the incident to relevant financial or cybersecurity authorities for further investigation. Additionally, users should verify the authenticity of any wallet-related communications by cross-referencing with official Trezor channels to avoid falling victim to similar attacks.