homepage-trexerio[.]wixstudio[.]com

Analysis of homepage-trexerio.wixstudio.com, observed as offline on 24 July 2026, identifies a confirmed brand-impersonation infrastructure targeting Google. The domain resolves to 34.144.206.118, an address owned by AS396982 Google LLC and located in the United States. Registration data show the domain was created on 17 December 2016 through GoDaddy.com, LLC and is served by the nsone.net name server set (dns1-p08.nsone.net, dns2-p08.nsone.net, dns3-p08.nsone.net, dns4-p08.nsone.net). The site presented a TLS certificate issued by Let’s Encrypt (R13) and enforced HSTS, while the underlying stack reported the use of Wix, React, Google Cloud services, Lodash, Google Cloud CDN, and HTTP/3.

The HTTP response returned a 404 status code, and the page title retrieved from the host was "Trezor.io/Start® — Starting Up Your Device | Trezor®", a mismatch to the declared brand target of Google, reinforcing the impersonation intent. VirusTotal scans recorded nine detections out of ninety‑one scanners, and the domain appears on a single external blocklist. PhishDestroy has also flagged the host as malicious.

The combination of a Google‑owned IP range, a legitimate‑looking SSL certificate, and content that references a third‑party product while claiming affiliation with Google demonstrates a typical brand‑impersonation pattern used to lure victims. Defenders should update network and DNS filtering policies to block both the domain name and its resolving IP, monitor for any future re‑registration of the same name or similar sub‑domains, and consider adding the associated IP to threat‑intel feeds. Continuous verification against reputable blocklist services and periodic re‑scanning of the domain, should it reappear, are recommended to maintain coverage.