more-trzor[.]wixstudio[.]com

This domain, more-trzor.wixstudio.com, is flagged as a crypto credential theft operation targeting users of Trezor hardware wallets. Analysis indicates the site impersonated legitimate Trezor infrastructure, likely to harvest wallet recovery phrases or private keys under the guise of account verification or firmware updates. No specific drainer kit signatures were identified in passive analysis, but the domain structure and naming convention strongly suggest intent to deceive users into divulging sensitive cryptographic credentials.

Technical indicators confirm the domain was registered on May 30, 2026, through GoDaddy.com, LLC, and resolved to IP address 34.144.206.118. At the time of detection, 15 of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. Infrastructure analysis reveals the use of Wix hosting, React framework, Google Cloud, and Google Cloud CDN, with HTTP/3 support. The SSL certificate was issued by Let's Encrypt, and no Google Safe Browsing (GSB) detections were recorded prior to takedown.

The domain has since been taken offline, and the page now returns a 404 error with the title '404 Error: Page Not Found | Wix Studio.' While the immediate threat is mitigated, residual risk remains for users who may have interacted with the domain prior to its removal. Organizations are advised to block the domain and IP at perimeter defenses, monitor for credential reuse, and review logs for connections to 34.144.206.118. Users should verify wallet integrity and rotate any potentially exposed recovery phrases or private keys.