iostarts-apps-trezon[.]wixstudio[.]com

This domain is flagged as a high-risk brand impersonation phishing site specifically targeting Trezor, a cryptocurrency hardware wallet provider. The threat involves presenting a fraudulent interface mimicking Trezor’s official setup portal, likely designed to harvest recovery seeds or credentials from unsuspecting users attempting to initialize their devices. The page title, 'Trézor.io/Start — Starting Up™ Your Device | Trezor®®,' closely replicates the legitimate Trezor onboarding process, increasing the likelihood of successful deception. Analysis indicates the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The site was detected by 13 out of 95 security vendors on VirusTotal, with appearances on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let’s Encrypt, a common practice among malicious actors to lend superficial legitimacy. Technologies detected on the domain include Wix as the hosting platform, React for frontend development, and Google Cloud CDN for content delivery, alongside HTTP/3 for optimized performance. The domain has since been taken offline, though its prior operational status poses residual risks to users who may have interacted with it. Mitigation steps for this specific threat type involve immediate verification of all Trezor-related domains before use. Users should access the official Trezor portal exclusively via trezor.io and cross-reference URLs with the vendor’s verified documentation. Organizations should enforce blocklisting of the domain and its associated IP (34.144.206.118) across network security controls, including firewalls, DNS filters, and endpoint protection systems. Security teams are advised to audit logs for connections to the domain or IP, particularly from endpoints handling cryptocurrency transactions. Given the use of Wix as a hosting platform, monitoring for similar impersonation domains under wixstudio.com or other subdomains is recommended. Users who may have entered sensitive information on the site should assume compromise, revoke access to associated wallets, and migrate assets to new, verified hardware or software instances.