trxzorcdn[.]wixstudio[.]com

This domain is flagged for elevated-risk brand impersonation targeting cryptocurrency hardware wallet users. Analysis indicates the infrastructure was specifically designed to deceive victims into believing they were accessing legitimate wallet management software, enabling unauthorized access to sensitive wallet credentials and recovery phrases.

Technical indicators confirm the domain trxzorcdn.wixstudio.com was registered through GoDaddy.com, LLC and resolved to IP address 34.144.206.118. Security vendors flagged the domain with a 5/95 detection ratio on VirusTotal, while five independent blocklists (MetaMask, PhishDestroy, PhishingArmy, SEAL, and OISD) actively blocked it. The page title mimicked the official Trezor Suite interface, displaying 'Official Trezor™ Suite — Desktop & Web App for Hardware Wallets™' to enhance credibility. The domain used a Let's Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. Infrastructure analysis reveals the domain was hosted on Wix Studio, a platform commonly abused for rapid phishing deployment due to its ease of use and free SSL provisioning.

Mitigation requires immediate action from both security teams and end-users. Network administrators should block the domain and associated IP 34.144.206.118 at the perimeter, while monitoring for residual connections. End-users who interacted with the domain should assume credential compromise and initiate recovery protocols, including revoking wallet access, generating new recovery phrases, and verifying hardware integrity. Cryptocurrency wallet providers should issue targeted alerts to users who may have been exposed, emphasizing the risks of entering seed phrases or private keys into unverified platforms. Security teams should monitor for similar impersonation patterns, particularly domains using 'trx,' 'trezor,' or 'cdn' in their naming conventions, as these are frequently exploited in credential harvesting campaigns.