bridgesapp-live[.]wixstudio[.]com

This domain, bridgesapp-live.wixstudio.com, is confirmed as a brand impersonation phishing site targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site masqueraded as the official Trezor Bridge application, using the page title 'Trézor Bridge® | Introducing the New Trezor® App' to deceive users into interacting with fraudulent infrastructure. No direct evidence of a crypto drainer kit was observed, but the site's design and branding strongly suggest intent to harvest credentials or distribute malicious payloads under the guise of a legitimate software update. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with HTTP/3 and Google Cloud CDN technologies detected. The SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy. At the time of assessment, the domain was flagged by 14 out of 95 security vendors on VirusTotal and appeared on three security blocklists: PhishDestroy, PhishingArmy, and OISD. No Google Safe Browsing (GSB) listing was confirmed, though this may reflect detection latency rather than absence of malicious activity. The domain has since been taken offline, likely in response to blocklistings and security vendor detections. However, residual risk remains due to the potential for infrastructure reuse or migration to new domains. Users who interacted with the site should assume credential exposure and revoke any active sessions tied to Trezor or related cryptocurrency services. Organizations are advised to monitor for similar impersonation attempts leveraging Wix-hosted subdomains or Google Cloud IPs, particularly those mimicking cryptocurrency brands with high-value targets.