connects-bridge[.]wixstudio[.]com

This domain, connects-bridge.wixstudio.com, has been identified as a crypto wallet drainer infrastructure impersonating Trezor, a hardware cryptocurrency wallet provider. The site is currently offline, though prior activity involved presenting a fraudulent page titled 'Trezor Bridge® | Introducing the New Trezor App,' designed to deceive users into interacting with malicious wallet-draining scripts. Analysis indicates this is not a generic phishing attempt but a targeted attack against cryptocurrency holders seeking legitimate wallet management tools. Infrastructure analysis reveals the domain was registered on December 17, 2016, through GoDaddy.com, LLC, and resolves to the IP address 34.144.206.118. As of the latest assessment, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating either recent deployment or effective evasion of detection mechanisms. No entries were found on major blocklists, and trust scores remain unassigned due to the lack of prior alerts. The use of a Wix Studio subdomain suggests an attempt to leverage a reputable hosting platform to lend credibility to the malicious operation. Current status indicates the domain has been taken offline, though the infrastructure may be reactivated or replicated under a different identifier. Users are advised to verify wallet software exclusively through official sources, such as the vendor’s authenticated domain. Cryptocurrency holders should enable hardware-based transaction signing and review wallet addresses for discrepancies before confirming transfers. Security teams are recommended to monitor for similar subdomain patterns under legitimate hosting services, particularly those mimicking wallet bridge or update utilities. Indicators of compromise include the domain connects-bridge.wixstudio.com, IP 34.144.206.118, and the fraudulent page title referencing Trezor Bridge.