connect-suitescdn[.]wixstudio[.]com

The domain connect-suitescdn.wixstudio.com is identified as a high-risk phishing site specifically designed to impersonate Trezor, a well-known cryptocurrency hardware wallet provider. Analysis confirms this domain mimics the official Trezor Suite application, targeting users seeking desktop or web-based wallet management tools. The threat type is classified as brand impersonation, with a focus on credential harvesting and potential financial fraud. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118. It is flagged by 14 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Technical indicators include the use of Wix hosting, React framework, Google Cloud CDN, and a Let's Encrypt SSL certificate. The page title, 'Official Trezor™ Suite — Desktop & Web App for Hardware Wallets,' further confirms the intent to deceive users into believing the site is legitimate. As of the latest verification, connect-suitescdn.wixstudio.com has been taken offline, reducing immediate risk to users. However, organizations and individuals are advised to block the domain and its associated IP address (34.144.206.118) at the network level to prevent potential re-emergence. Users who may have interacted with this domain should immediately revoke any credentials or session tokens associated with Trezor or cryptocurrency services. Monitoring for similar impersonation domains using the same infrastructure (e.g., Wix, Google Cloud) is recommended for proactive threat mitigation.