startsso-treziocdn[.]wixstudio[.]com

The domain startsso-treziocdn.wixstudio.com is confirmed to be a brand impersonation site targeting the Trezor brand. The site is currently offline, reducing immediate risk, but it remains a significant threat to users who may have interacted with it before it was taken down.

Infrastructure analysis reveals that the domain was flagged by 4 out of 95 security vendors on VirusTotal, indicating a moderate level of detection. The domain is registered through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. The site was built using Wix and React, with hosting and CDN services provided by Google Cloud and Google Cloud CDN. Additionally, the site supports HTTP/3, which can enhance its performance and user experience, potentially making it more convincing to unsuspecting users. The SSL certificate is issued by Let's Encrypt, adding a layer of trust that could be exploited to gain user confidence. The domain appears on 3 security blocklists: PhishDestroy, PhishingArmy, and OISD, further confirming its malicious nature.

Given the current status of the domain as offline, the immediate threat is mitigated. However, users are advised to remain vigilant and avoid interacting with any similar domains or URLs that claim to be associated with Trezor. Security teams should monitor for any reactivation of the domain and consider implementing additional blocking and alerting mechanisms to protect users. Organizations should also educate their employees on the signs of brand impersonation and the importance of verifying the authenticity of websites through official channels.