trezos-suites[.]wixstudio[.]com

PhishDestroy identifies trezos-suites.wixstudio.com as an active credential theft page impersonating Trezor’s admin interface, leveraging a WixStudio subdomain to deceive victims into surrendering login credentials (a55347). The page mimics Trezor’s legitimate authentication workflow to harvest credentials for downstream theft of cryptocurrency assets. No crypto drainer kit artifacts or Web3 wallet signature prompts were observed during passive analysis, indicating a simpler but highly effective credential harvesting campaign. This domain was flagged on 2024-05-29 with an SSL certificate issued by Let’s Encrypt valid until 2024-08-27. It resolves to a Google Cloud IP (34.144.206.118) via Wix’s infrastructure. WHOIS data shows a recent creation date of 2024-05-22 and is registered through Wix.com. VirusTotal currently shows 0 detections across 95 engines as of 2024-05-29 14:32 UTC. The domain has not been blocklisted by Google Safe Browsing (GSB) and has zero detections on PhishTank, OpenPhish, and URLVoid at the time of writing. The threat remains active with low visibility due to zero detections across major scanners. Immediate blocking of trezos-suites.wixstudio.com at network and browser levels is advised. Users should treat any unsolicited Trezor admin login prompts with heightened skepticism and verify endpoints via official Trezor domains only. No evidence of infrastructure takedown has been observed; risk remains elevated until proactive remediation by hosting provider.