trezo-appsuite[.]wixstudio[.]com

PhishDestroy identifies trezo-appsuite.wixstudio.com as an active crypto drainer impersonating the Trezor Wallet brand. This Wix-hosted domain leverages a spoofed interface to trick users into connecting crypto wallets or entering seed phrases, aiming to drain digital assets directly. The threat actor behind this campaign uses a generic Wix subdomain structure to mimic legitimate crypto service interfaces, capitalizing on user trust in established wallet brands.

Technical indicators confirm this domain resolves to IP 34.144.206.118 and operates under VirusTotal’s radar with 4/95 detections. The domain, registered via Wix’s hosting infrastructure, lacks a publicly disclosed creation date but utilizes a Let’s Encrypt SSL certificate to enhance credibility. Google Safe Browsing (GSB) has not yet flagged this domain, and blocklist counts remain at zero, indicating a newly emerged or stealthily operated threat.

As of the latest analysis, trezo-appsuite.wixstudio.com remains active with a status tagged as under_investigation. PhishDestroy is monitoring this domain closely and has flagged it for further takedown actions. Users are advised to verify all wallet-related URLs via PhishDestroy’s database and avoid interacting with this domain. Remaining risk is classified as active but localized, with no confirmed victim reports at this time. Immediate action is recommended to prevent potential asset loss.