global-trexorcdn[.]wixstudio[.]com

This domain, global-trexorcdn.wixstudio.com, is flagged as a high-risk instance of brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The site presented itself as an official platform, using the page title 'Trézor Bridge® | Introducing the New Trezor® App' to deceive visitors into believing it was a legitimate service. As of the latest assessment, the domain has been taken offline, though prior activity indicates a deliberate attempt to exploit users through fraudulent branding. Analysis indicates the domain was hosted on infrastructure resolving to the IP address 34.144.206.118, leveraging technologies including Wix, React, Google Cloud, and Google Cloud CDN. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to malicious sites. The domain was registered through GoDaddy.com, LLC, a widely used registrar. Security vendors on VirusTotal flagged this domain as malicious, with 11 out of 95 engines detecting it as a threat. Additionally, the domain appeared on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, further corroborating its malicious classification. The current status of global-trexorcdn.wixstudio.com is offline, reducing immediate exposure to end users. However, the infrastructure and tactics observed suggest a persistent threat actor. Organizations and individuals are advised to monitor for similar domains using Trezor branding, particularly those hosted on cloud-based platforms or leveraging free SSL certificates. Network administrators should update blocklists to include the IP address 34.144.206.118 and related indicators of compromise. Users who may have interacted with this domain should verify their systems for unauthorized access or data exposure and consider resetting credentials associated with cryptocurrency services.