appbridge-trexz[.]wixstudio[.]com

This domain, appbridge-trexz.wixstudio.com, is identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to deceive users by presenting itself as an official Trezor Bridge update page, with the title 'Official Trézor® Bridge®| Introducing the New Trezor®.' The infrastructure mimics legitimate Trezor communication channels, likely intending to distribute malicious payloads or harvest credentials under the guise of a software update. No direct evidence of a crypto drainer kit was observed, but the domain’s intent aligns with common tactics used in cryptocurrency-related fraud. Technical indicators confirm the domain’s malicious nature. The domain is flagged by 14 out of 95 security vendors on VirusTotal, with detections spanning phishing, brand impersonation, and malicious site categories. It was registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Infrastructure analysis reveals the use of Wix, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3, suggesting a modern, cloud-based hosting environment designed to evade detection. The domain is currently offline, likely due to takedown actions by hosting providers or security teams. However, the risk of re-emergence remains, as threat actors frequently repurpose infrastructure or register similar domains. Users who interacted with this domain should assume potential exposure of sensitive credentials or wallet information. Immediate actions include revoking access to any Trezor-related accounts, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP, while users are advised to verify the authenticity of any Trezor-related communications through official channels only.