engtrezsuite[.]wixstudio[.]com

PhishDestroy identifies engtrezsuite.wixstudio.com as an active crypto drainer impersonating Trezor hardware wallets, attempting to trick users into revealing private keys or approving malicious transactions. The domain leverages WixStudio’s hosting infrastructure to appear legitimate, deploying a fraudulent interface that mimics Trezor’s official suite for credential theft and asset exfiltration. No specific drainer kit (e.g., MetaMask, Phantom, or Ledger phishing clones) has been confirmed, but the payload likely includes clipboard hijackers or malicious wallet connection prompts.

Technical indicators reveal this domain resolves to IP 34.144.206.118, secured with a Let’s Encrypt SSL certificate (common among fraudulent sites to avoid browser warnings). VirusTotal currently reports 5/95 detections, indicating evasion of signature-based antivirus tools. The domain is registered via Wix Inc. (likely through WixStudio’s subdomain service) and lacks historical blocklist data, suggesting recent deployment. Creation date and Google Safe Browsing (GSB) status remain unverified due to active investigation status.

This domain remains active with an 'under_investigation' status, posing a high risk to cryptocurrency users. Immediate actions include blocking the domain/IP at the network perimeter, flagging in threat intelligence feeds, and educating users to verify Trezor Suite URLs via official channels. Remaining risk is elevated due to low detection rates and reliance on HTTPS, requiring proactive monitoring for new IOCs.