trzor-eng[.]wixstudio[.]com

This domain, trzor-eng.wixstudio.com, was identified as a high-risk brand impersonation threat specifically targeting users of Trezor, a hardware cryptocurrency wallet provider. The site presented itself as an official Trezor resource, using the page title 'Official Trézor® Bridge| Introducing the New Trezor®' to deceive visitors into believing they were interacting with legitimate infrastructure. Such impersonation attempts typically aim to harvest sensitive credentials, seed phrases, or private keys, which could lead to unauthorized access to cryptocurrency wallets and financial theft. The use of a homoglyph in the domain name ('trzor' instead of 'trezor') further increased the likelihood of successful deception, particularly among users who may not scrutinize URLs closely during high-pressure scenarios. Analysis indicates this domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with technologies including Wix, React, and Google Cloud CDN. The domain was flagged by 15 out of 95 security vendors on VirusTotal, and it appeared on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility and automation. Despite its current offline status, the domain’s infrastructure and historical activity provide clear indicators of malicious intent, particularly given its alignment with known phishing tactics targeting cryptocurrency users. Users who visited trzor-eng.wixstudio.com should assume their interactions may have been compromised. Immediate steps include revoking any permissions granted to the site, rotating credentials for associated accounts, and monitoring for unauthorized transactions. If sensitive information such as seed phrases or private keys was entered, affected wallets should be considered compromised, and funds should be transferred to a new, secure wallet. Additionally, users are advised to review browser extensions, installed applications, and device security for any signs of compromise, as phishing sites may deploy secondary payloads or redirect to further malicious resources. Ongoing vigilance is recommended, particularly for those who engaged with the site while it was active.