ioapps-starts-treor[.]wixstudio[.]com

The domain ioapps-starts-treor.wixstudio.com has been identified as a high-risk brand impersonation resource targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to mimic the official Trezor device initialization portal, specifically replicating the page title 'Trezor.io/Start® — Starting Up Your Device | Trezor®.' This domain is currently offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was flagged by 13 of 95 security vendors on VirusTotal, with additional detections on three distinct security blocklists: PhishDestroy, PhishingArmy, and OISD. The domain resolves to the IP address 34.144.206.118, hosted on infrastructure associated with Google Cloud and Google Cloud CDN. The SSL certificate was issued by Let's Encrypt, a common practice among threat actors to lend superficial legitimacy. Registration details indicate the domain was provisioned through GoDaddy.com, LLC, though no creation date is publicly available for this subdomain under the WixStudio platform. Technologies detected include Wix, React, and HTTP/3, consistent with modern web development frameworks often exploited for phishing campaigns. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to monitor for unauthorized access to cryptocurrency wallets, particularly those associated with Trezor devices. Network administrators should block the IP address 34.144.206.118 and the domain ioapps-starts-treor.wixstudio.com at the perimeter. Users who may have entered credentials or recovery seeds on this portal should immediately transfer assets to a new wallet and revoke any compromised access. Enhanced scrutiny of similar subdomains under WixStudio or other content delivery platforms is recommended to prevent recurrence.