live-bridgecdn[.]wixstudio[.]com

This domain, live-bridgecdn.wixstudio.com, has been identified as a high-risk brand impersonation threat targeting Trezor, a well-known cryptocurrency hardware wallet provider. The domain was designed to mimic the official Trezor platform, presenting itself under the title 'Trézor Bridge® | Introducing the New Trezor® App.' Analysis indicates this was an active attempt to deceive users into interacting with fraudulent infrastructure, likely to facilitate unauthorized access to cryptocurrency assets or sensitive credentials. The domain is currently offline, but its prior activity warrants close scrutiny. Infrastructure analysis reveals the domain resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. It employed a Let's Encrypt SSL certificate, which, while common among legitimate sites, is frequently exploited by malicious actors to lend a false sense of security. The domain was registered through GoDaddy.com, LLC, a widely used registrar that has been associated with numerous phishing campaigns. Security vendors flagged this domain on VirusTotal, with 11 out of 95 vendors marking it as malicious. Additionally, the domain appeared on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further corroborating its fraudulent nature. Technologies detected on the domain include Wix, React, Google Cloud, Google Cloud CDN, and HTTP/3, which are consistent with modern phishing frameworks designed to evade detection and enhance scalability. As of the latest assessment, live-bridgecdn.wixstudio.com has been taken offline, reducing immediate exposure to potential victims. However, the domain's prior activity and technical indicators suggest a sophisticated operation targeting cryptocurrency users. Organizations and individuals are advised to block the domain and associated IP address (34.144.206.118) at the network level to prevent any residual access attempts. Users who may have interacted with this domain should immediately revoke any associated credentials, monitor their cryptocurrency wallets for unauthorized transactions, and consider reporting the incident to relevant cybersecurity authorities. Proactive measures, such as enabling multi-factor authentication and verifying domain authenticity before engaging with financial platforms, are strongly recommended to mitigate similar threats in the future.