oficial-trexo-starts[.]wixstudio[.]com

This domain, oficial-trexo-starts.wixstudio.com, is identified as a high-risk brand impersonation threat targeting Trezor hardware wallet users. The site mimics the official Trezor device initialization process, specifically replicating the Trezor.io/Start® page title, to deceive users into entering sensitive credentials or recovery seeds. Analysis confirms the domain is currently offline but was previously active in phishing campaigns. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118 and was registered through a widely used registrar. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. VirusTotal detection shows 12 of 95 security vendors flagged this domain as malicious. The SSL certificate was issued by Let's Encrypt, a common certificate authority leveraged in both legitimate and malicious domains. Detected technologies include Wix hosting, React framework, Google Cloud infrastructure, and HTTP/3 protocol support, indicating a modern web presence designed to evade basic detection mechanisms. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. Organizations and individuals are advised to block the domain and associated IP address in network security controls. Users who accessed this domain should assume credential exposure and initiate recovery procedures, including seed phrase regeneration and device reinitialization. Monitoring for similar domains using Trezor branding or Wix-hosted subdomains is recommended for proactive threat mitigation.