io-startsappen[.]wixstudio[.]com

This domain, io-startsappen.wixstudio.com, presents a brand impersonation threat targeting users of Trezor, a cryptocurrency hardware wallet. The site mimics the official Trezor device setup process, displaying the page title 'Trézor.io/Start — Starting Up™ Your Device | Trezor®®' to deceive visitors into entering sensitive recovery phrases or private keys. Such impersonation schemes are designed to harvest cryptographic credentials, enabling attackers to gain unauthorized access to victims' digital assets. The fraudulent nature of this site is further evidenced by its attempt to replicate Trezor’s branding, including the use of trademark symbols and a URL structure resembling legitimate setup pages. Analysis indicates the domain was flagged by four out of ninety-five security vendors on VirusTotal, a notable indicator of malicious activity despite its current offline status. The domain was registered through GoDaddy.com, LLC, a common registrar for both legitimate and fraudulent sites, and resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure. Additional technical indicators include the use of Let’s Encrypt SSL certificates, Wix hosting, React for frontend development, and Google Cloud CDN for content delivery. The presence of HTTP/3 further suggests an attempt to appear modern and legitimate, though these technologies are frequently exploited in phishing campaigns to evade detection. Users who visited io-startsappen.wixstudio.com should assume their credentials or recovery phrases may have been compromised. Immediate action is required: disconnect any devices that interacted with the site, revoke access to any associated cryptocurrency wallets, and initiate a full security review of linked accounts. If recovery phrases or private keys were entered, transfer remaining assets to a new, secure wallet using a trusted device. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where possible. Given the elevated risk level, affected individuals should also report the incident to relevant financial and cybersecurity authorities to aid in tracking and mitigating further threats.