bridge-globalcdn[.]wixstudio[.]com

This domain, bridge-globalcdn.wixstudio.com, poses a high-risk brand impersonation threat specifically targeting Trezor, a cryptocurrency hardware wallet provider. The site masquerades as an official Trezor resource, presenting itself under the title 'Trézor Bridge® | Introducing the New Trezor® App.' Such impersonation is designed to deceive users into divulging sensitive information, including wallet credentials, recovery seeds, or other authentication details, under the guise of legitimate software updates or services. The threat is particularly severe given the financial implications of compromised cryptocurrency assets, which are often irrecoverable once transferred to malicious actors. Analysis indicates the domain was flagged by 13 out of 95 security vendors on VirusTotal, a significant detection rate that underscores its malicious nature. The domain resolves to the IP address 34.144.206.118 and was registered through GoDaddy.com, LLC. Infrastructure analysis reveals the use of Wix, Envoy, React, Google Cloud, and Google Cloud CDN, alongside HTTP/3 for content delivery. The SSL certificate is issued by Let's Encrypt, a common but not exclusive indicator of legitimacy. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further confirming its classification as a phishing resource. Despite its current offline status, the domain's prior activity and infrastructure warrant continued vigilance. Users who visited bridge-globalcdn.wixstudio.com or interacted with its content should take immediate remedial action. First, disconnect any devices that accessed the site from networks and external storage to prevent potential malware propagation. Second, assume any credentials or recovery seeds entered on the site are compromised and initiate account recovery procedures through official Trezor channels. Third, monitor all associated cryptocurrency wallets and financial accounts for unauthorized transactions, reporting any anomalies to the respective service providers. If the site was accessed via a corporate or shared device, notify internal security teams to conduct a forensic analysis and contain potential lateral movement within the network. Given the high-risk nature of this threat, affected users should also consider revoking and reissuing any API keys or authentication tokens linked to the impersonated service.