bridgepp-trez[.]wixstudio[.]com

This domain is classified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The site masqueraded as an official Trezor application, specifically promoting a fraudulent "Trézor Bridge® | Introducing the New Trezor® App," likely designed to harvest credentials or distribute malicious software to compromise cryptocurrency assets. Brand impersonation of this nature is frequently associated with crypto drainers, fake login portals, or malware distribution, posing significant financial and operational risks to users who interact with the infrastructure. Analysis indicates the domain was registered through GoDaddy.com, LLC and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. At the time of assessment, 15 out of 95 security vendors on VirusTotal flagged the domain as malicious. The site was blocked by three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Detected technologies included Wix as the hosting platform, React for frontend development, and Google Cloud CDN for content delivery, alongside HTTP/3 protocol usage. The SSL certificate was issued by Let’s Encrypt, a common but not inherently trustworthy certificate authority often exploited in phishing campaigns. The domain’s current status is offline, though prior activity and detection rates confirm its malicious intent. To mitigate risks associated with this threat, users should immediately verify the authenticity of any Trezor-related communications or applications by accessing official sources directly. Cryptocurrency wallet interactions should be restricted to verified domains, such as trezor.io, and users should enable multi-factor authentication where available. Organizations should update security blocklists to include this domain and its associated IP (34.144.206.118) to prevent future access. Monitoring for similar impersonation attempts—particularly those leveraging cloud hosting (e.g., Google Cloud) and content delivery networks—is recommended, as these are common tactics in phishing infrastructure. If credentials or wallet information were entered on this site, affected parties should assume compromise and take immediate steps to secure accounts, including revoking access to connected applications and transferring assets to new, secure wallets.