ioapps-startsio-tre[.]wixstudio[.]com

The domain ioapps-startsio-tre.wixstudio.com is identified as a brand impersonation threat specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic the official Trezor setup portal, as indicated by the page title 'Trezor.io/Start® — Starting Up Your Device®.' Currently, the domain is offline, though it remains a documented case of fraudulent infrastructure. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on a cloud platform. Security vendors on VirusTotal flagged the domain, with 12 out of 95 engines detecting malicious activity. The domain appears on one security blocklist and was previously blocked by a specialized anti-fraud system. Technical indicators include the use of a Let’s Encrypt SSL certificate and technologies such as Wix, React, Google Cloud, and HTTP/3, which are consistent with modern phishing frameworks but do not inherently confirm legitimacy. Given the domain’s offline status, immediate interaction risks are mitigated; however, the infrastructure remains a documented threat. Users are advised to verify all cryptocurrency-related domains directly through official sources, avoid clicking on unsolicited links, and monitor for unauthorized access attempts. Organizations should update blocklists to include this domain and similar patterns, such as subdomains under wixstudio.com mimicking legitimate services. Proactive monitoring of cloud-hosted domains with low-reputation SSL certificates is recommended to detect emerging impersonation threats.