view-trexoapp[.]wixstudio[.]com

The domain view-trexoapp.wixstudio.com is identified as a high-risk brand impersonation threat specifically targeting Trezor, a hardware cryptocurrency wallet provider. Analysis confirms this domain operates as a crypto drainer, designed to deceive users into interacting with fraudulent wallet interfaces that facilitate unauthorized asset transfers. The domain is currently offline, though prior activity indicates malicious intent. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, with detection counts indicating widespread recognition as malicious. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs a Let's Encrypt SSL certificate to simulate legitimacy. The domain was registered through GoDaddy.com, LLC, and appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Technologies detected include Wix, React, Lodash, and Google Cloud CDN, which are consistent with modern phishing frameworks designed to evade detection. Current status confirms the domain has been taken offline, though similar threats may re-emerge under different domains or subdomains. Users are advised to verify all wallet interfaces against official sources, avoid interacting with unsolicited links, and employ hardware-based multi-factor authentication for cryptocurrency transactions. Security teams should monitor for related indicators of compromise, including the IP address 34.144.206.118 and associated infrastructure, to prevent further exploitation.