trezorwalazt[.]webflow[.]io

This report details a malicious domain targeting cryptocurrency users. The site, trezorwalazt.webflow.io, presented a page titled "Trezor % Wallet - The Secure Wallet Extension" and was identified as a cryptocurrency scam impersonating the legitimate Trezor brand. The threat posed by this site was credential theft or asset theft, as it likely aimed to trick users into revealing their wallet recovery phrases or login details by posing as an official Trezor wallet extension.

Technical evidence confirms the malicious nature of this domain. VirusTotal flagged the site with 17 detections out of 95 security vendors. It was specifically flagged by alphaMountain.ai, BitDefender, Certego, CRDF, and CyRadar, and appeared on 2 blocklists. The domain is hosted on IP address 172.64.151.8, located in the United States, and is associated with AS13335 (Cloudflare, Inc.). It was registered through MarkMonitor, Inc., with a creation date of 2013-05-08, and uses an SSL certificate from Google Trust Services (WE1). Its nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com.

The current status of the site is DOWN or OFFLINE, indicating it is no longer accessible. The risk level is high due to the confirmed impersonation of a well-known cryptocurrency brand and the high number of vendor detections. Users should be advised that any interaction with this domain could have led to financial loss, and no further engagement is possible.