starts-trzzoncdn[.]wixstudio[.]com

This domain, starts-trzzoncdn.wixstudio.com, is identified as a high-risk crypto wallet drainer campaign targeting users of Trezor hardware wallets. Analysis of the page title, 'Getting™ Started | Trézor.io/Start®,' confirms brand impersonation tactics designed to deceive victims into entering sensitive recovery phrases or private keys. The infrastructure mimics the legitimate Trezor onboarding process, a common vector for cryptocurrency theft, where stolen credentials are used to drain wallet balances irreversibly. Infrastructure analysis reveals the domain resolves to the IP address 34.144.206.118 and was registered through GoDaddy.com, LLC. The SSL certificate is issued by Let's Encrypt, providing a false sense of security. Detection metrics indicate 11 out of 95 security vendors on VirusTotal flag the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. No creation date is available for this subdomain, but the parent domain, wixstudio.com, is a legitimate platform often abused for hosting malicious content due to its accessibility and free-tier offerings. As of the latest assessment, the domain has been taken offline, likely in response to abuse reports or automated takedown mechanisms. However, the risk of re-emergence remains high, as threat actors frequently rotate subdomains or shift to new hosting providers. Users who may have interacted with this domain are advised to immediately revoke any wallet access permissions, transfer remaining funds to a new wallet, and monitor for unauthorized transactions. Organizations should update blocklists to include the IP address 34.144.206.118 and the domain pattern 'trzzoncdn' to prevent future exposure.