iio-trezo-starts[.]wixstudio[.]com

This domain, iio-trezo-starts.wixstudio.com, presents a high-risk brand impersonation threat targeting users of Trezor hardware wallets. The page mimics the official Trezor device initialization process, displaying the title 'Trézor.io/Start — Starting Up™ Your Device | Trezor®®' to deceive victims into entering sensitive credentials, such as recovery seeds or wallet passwords. The fraudulent site leverages visual and textual elements identical to Trezor’s legitimate interface, increasing the likelihood of successful social engineering attacks against cryptocurrency users seeking to set up or recover their devices.

Analysis of the domain’s infrastructure reveals multiple red flags. The domain is flagged by 10 out of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It appears on three security blocklists, including PhishDestroy and PhishingArmy, and is registered through GoDaddy.com, LLC. The site resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs technologies such as Wix, React, and Google Cloud CDN. The SSL certificate is issued by Let’s Encrypt, a common tool used by both legitimate and malicious sites to encrypt traffic. Despite its current offline status, the domain’s prior activity and technical indicators confirm its role in credential harvesting operations.

Users who visited this domain should take immediate action to mitigate potential compromise. If any credentials, recovery seeds, or wallet information were entered, the affected Trezor device should be considered at risk. Users are advised to initiate a secure device wipe, generate a new recovery seed, and transfer any remaining assets to a new wallet. Additionally, monitoring for unauthorized transactions and enabling multi-factor authentication on associated accounts is recommended. The domain’s presence on multiple blocklists underscores the importance of verifying URLs before interacting with any hardware wallet setup or recovery pages.