home-trexsercdn[.]wixstudio[.]com

This domain poses a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The site mimics the official Trezor setup portal (Trézor.io/Start) to deceive users into entering recovery seeds or private keys, enabling unauthorized access to crypto wallets. Analysis indicates the page title explicitly replicates Trezor’s branding, including trademark symbols and URL structure, increasing the likelihood of successful social engineering attacks against wallet users. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to IP address 34.144.206.118. Security vendors on VirusTotal flagged the domain 13 out of 95 times, while three blocklists (PhishDestroy, PhishingArmy, OISD) have added it to their denylists. The site employed a Let’s Encrypt SSL certificate and utilized Wix hosting with React, Google Cloud, and HTTP/3 technologies. Despite its current offline status, historical activity suggests prior malicious use. Users who visited this domain should immediately revoke any entered recovery seeds or private keys, as these credentials may have been compromised. Affected individuals should transfer remaining funds to a new wallet with a fresh seed phrase and monitor their accounts for unauthorized transactions. If credentials were reused across other platforms, those should be updated immediately. Security teams are advised to block the domain and associated IP (34.144.206.118) at the network level to prevent further exposure.