welcome-staking-home[.]webflow[.]io

This domain, welcome-staking-home.webflow.io, operates as a fraudulent Ethereum staking portal designed to impersonate legitimate cryptocurrency hardware wallet services. Analysis indicates the site specifically mimics Trézor-branded staking interfaces, presenting users with fake Ethereum (ETH) staking opportunities under the fabricated page title 'Trézor staking® | Staking Ethereum (ETH) on TréZor.' The infrastructure targets individuals seeking to stake cryptocurrency assets, likely harvesting wallet credentials, recovery phrases, or directing victims to transfer funds to attacker-controlled addresses. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on February 21, 2026, through NameCheap, Inc., and currently resolves to IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). Security vendor detections on VirusTotal report 17 out of 95 engines flagging the domain as malicious. The domain appears on one security blocklist and is secured with a Google Trust Services SSL certificate (WE1), which may lend false legitimacy to unsuspecting users. The site was subsequently taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Users who visited welcome-staking-home.webflow.io should immediately cease all interaction and assume credential compromise. Any cryptocurrency wallets or accounts accessed through this domain must be considered at risk. Affected individuals should revoke active sessions, rotate all associated passwords and recovery phrases, and transfer assets to new, secure wallets. Monitoring for unauthorized transactions is recommended, and any suspicious activity should be reported to relevant financial or blockchain security teams for further investigation.