homestarted-trexorr[.]wixstudio[.]com

The domain homestarted-trexorr.wixstudio.com has been identified as a confirmed phishing site specializing in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site was designed to mimic the official Trezor setup process, as evidenced by the page title 'Trézor.io/Start®® — Starting Up™ Your Device | Trezor®,' which closely resembles legitimate branding and terminology. The domain is currently offline, though its infrastructure and historical activity warrant further scrutiny. Infrastructure analysis reveals the domain was flagged by 6 of 95 security vendors on VirusTotal, indicating a moderate but notable level of detection. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies such as Wix, React, Lodash, and Google Cloud CDN. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and was registered through GoDaddy.com, LLC. The SSL certificate is issued by Let's Encrypt, a common but not inherently malicious certificate authority. The use of HSTS and HTTP/3 suggests an attempt to appear legitimate, though these features do not mitigate the underlying threat. Current status indicates the domain has been taken offline, reducing immediate risk to users. However, the technical indicators and historical detections suggest this was a deliberate phishing operation. Organizations and individuals are advised to block the domain and associated IP address 34.144.206.118 at the network level. Users who may have interacted with the site should verify their device integrity, monitor for unauthorized transactions, and reset credentials for any accounts linked to cryptocurrency services. Security teams should review logs for connections to the domain or IP and investigate potential compromise indicators.