homepage-bridgeus[.]wixstudio[.]com

The domain homepage-bridgeus.wixstudio.com has been identified as a brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates this domain was designed to mimic Trezor’s official software, specifically presenting itself as the 'Trézor Bridge® | Introducing the New Trezor® App.' The domain is currently offline, but prior activity suggests it was used to deceive users into interacting with fraudulent infrastructure, potentially leading to credential theft or unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the domain was flagged by 3 of 95 security vendors on VirusTotal, indicating a moderate but confirmed level of malicious activity. It was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. The domain appeared on one security blocklist and employed technologies including Wix, React, Google Cloud CDN, and HTTP/3. The SSL certificate was issued by Let’s Encrypt, a common but not exclusive indicator of legitimate domains. The page title explicitly referenced Trezor’s branding, reinforcing the impersonation tactic. Current status confirms the domain is offline, reducing immediate risk to users. However, the infrastructure and tactics observed warrant continued vigilance. Users who may have interacted with this domain are advised to verify their device integrity, revoke any suspicious wallet authorizations, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. Cryptocurrency users are reminded to access official software exclusively through verified sources, such as the vendor’s official website, and to validate SSL certificates and domain authenticity before entering sensitive information.