startio-trezos[.]wixstudio[.]com

The domain startio-trezos.wixstudio.com has been identified as a high-risk brand impersonation threat targeting the Trezor brand. The site posed as a legitimate Trezor resource, specifically focusing on device setup instructions, which could mislead users into providing sensitive information or downloading malicious content. No drainer kit has been detected in the analysis.

Technical indicators confirm the malicious nature of this domain. VirusTotal flagged startio-trezos.wixstudio.com with a score of 14/95, indicating a moderate level of detection among security vendors. The domain was registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The SSL certificate is issued by Let's Encrypt, which is a common choice for phishing sites to appear more trustworthy. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and is listed in the Google Safe Browsing (GSB) database as a known phishing site. These factors, combined with the use of Wix, React, Google Cloud, Lodash, HSTS, and Google Cloud CDN, suggest a sophisticated and well-organized phishing operation.

As of the latest assessment, the domain is currently offline. However, the offline status does not eliminate the risk, as the site could be reactivated at any time. Immediate response actions include adding the domain to internal blocklists and warning users to avoid any links or redirects to this domain. Despite the domain being offline, the remaining risk is high due to the potential for re-deployment and the likelihood that some users may have already been compromised. Continuous monitoring and updating of security measures are recommended to prevent future incidents.