enstartsio-trexor[.]wixstudio[.]com

This domain operates as a fraudulent cryptocurrency wallet initialization portal targeting users of legitimate hardware wallet services. Analysis indicates the site impersonates the official Trézor.io/Start setup page, using identical branding, layout, and domain structure to deceive victims into entering sensitive recovery phrases or private keys. The page title, 'Official Site® | Trézor.io/Start®®,' explicitly claims authenticity, while the underlying infrastructure reveals malicious intent through technical indicators. Infrastructure analysis reveals the domain resolves to 34.144.206.118, a Google Cloud IP address, and employs a Let's Encrypt SSL certificate to simulate legitimacy. Detection engines on VirusTotal flagged this domain with 5 out of 95 security vendors identifying it as malicious. The site is registered through a commercial registrar and leverages Wix hosting, React, and Google Cloud CDN technologies. It appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, confirming its classification as a phishing threat. Users who visited this domain should immediately revoke any entered credentials or recovery phrases, as these are likely compromised. All cryptocurrency wallet software should be reinstalled from the official vendor source, and any connected devices should undergo a factory reset. Monitor financial accounts for unauthorized transactions and enable multi-factor authentication where available. If sensitive information was submitted, consider the associated wallet or accounts permanently compromised and migrate assets to new, secure wallets using verified setup procedures.