ioapp-trezstarts[.]wixstudio[.]com

This domain, ioapp-trezstarts.wixstudio.com, is identified as a brand impersonation threat specifically targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the page mimics the legitimate Trezor.io/Start setup portal, using the page title 'Trezor.io/Start® | Starting Up Your Device | Trezor®' to deceive users into believing they are interacting with official Trezor infrastructure. No direct evidence of a crypto drainer kit was observed, but the domain’s intent aligns with credential harvesting or device compromise tactics commonly used in cryptocurrency phishing schemes.

Technical indicators confirm the domain’s malicious classification. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious. The domain was registered through GoDaddy.com, LLC, and currently resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Technologies detected include Wix, React, Lodash, HSTS, Google Cloud CDN, and HTTP/3, suggesting a modern, cloud-based phishing framework. The domain appears on three security blocklists: PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its accessibility. No creation date was provided, and the domain is not currently listed in Google Safe Browsing (GSB) at the time of analysis.

As of the latest assessment, the domain has been taken offline, likely due to hosting provider intervention or registrar enforcement. While the immediate threat is mitigated, the infrastructure remains a residual risk. Users who accessed the domain prior to its takedown may have exposed sensitive credentials or recovery seeds. Trezor users are advised to verify all URLs against the official trezor.io domain, enable hardware-based two-factor authentication, and monitor wallet activity for unauthorized transactions. The elevated risk level persists due to the domain’s prior activity and the potential for re-deployment under a different host or registrar.