connect-suitapps[.]wixstudio[.]com

The domain connect-suitapps.wixstudio.com is presently flagged as a brand‑impersonation site targeting Trezor. The site’s page title reads “Official Trezor™ Suite — Desktop & Web App for Hardware Wallets™”, directly referencing the Trezor brand and suggesting a fraudulent copy of the official suite. Technical reconnaissance shows the domain resolves to IP 34.144.206.118, an address owned by Google LLC (AS396982) located in the United States. The hosting infrastructure is provided through Wix Studio, as indicated by the registration details and the four NSONE nameservers (dns1.p08.nsone.net through dns4.p08.nsone.net). The site runs on a Wix stack with React, Google Cloud services, Lodash, HTTP/3, HSTS, and Google Cloud CDN.

An SSL certificate issued by Let’s Encrypt (R13) is present, but the server returns an HTTP 404 status, and the domain has been taken offline according to current observations. Threat intelligence records show the domain appears on a single security blocklist and is blocked by PhishDestroy. VirusTotal analysis reports that five of ninety‑one scanning engines have flagged the domain, reinforcing the suspicion of malicious intent. The domain was originally created on 17 December 2016, indicating a long‑standing registration that may have been repurposed for this campaign.

While the site is currently offline, the combination of brand‑specific page title, targeted impersonation of Trezor, and detection by multiple security vendors suggests a deliberate attempt to harvest credentials or distribute malicious payloads. Defenders should continue to block the domain at perimeter filters, monitor for any re‑activation, and consider adding the associated IP address to deny‑lists. Users of Trezor products should be advised to verify URLs against official sources and to avoid entering credentials on sites that display the aforementioned page title or use similar Wix‑based infrastructure.