iostartd-trexerio[.]wixstudio[.]com

This domain, iostartd-trexerio.wixstudio.com, is flagged for brand_impersonation targeting Trezor hardware wallet users. The site replicates the legitimate Trezor.io/Start page, presenting a fraudulent interface designed to harvest cryptocurrency wallet recovery seeds, passwords, or other sensitive authentication credentials during the device initialization process. Analysis indicates the domain was constructed to exploit users unfamiliar with official Trezor onboarding procedures, potentially leading to unauthorized access to digital assets. Infrastructure analysis reveals the domain resolved to IP address 34.144.206.118 and was hosted on a platform utilizing Wix, React, Google Cloud, and Google Cloud CDN. It employed a Let's Encrypt SSL certificate, registered through a major domain registrar. The domain appears on 1 security blocklist and is detected by 11 out of 95 security vendors on VirusTotal, confirming its malicious classification. The page title, 'Trezor.io/Start® — Starting Up Your Device | Trezor®,' precisely mimics the legitimate Trezor setup page, increasing the likelihood of successful deception. Users who visited iostartd-trexerio.wixstudio.com should immediately cease all interaction with the site. If any sensitive information, such as recovery seeds or passwords, was entered, users must transfer assets from the affected wallet to a new, secure wallet with a fresh recovery seed. Additionally, they should monitor the original wallet for unauthorized transactions and consider revoking any connected authorizations. Devices used to access the domain should undergo a full malware scan to detect potential secondary infections. Users are advised to verify domain authenticity by cross-referencing URLs with official sources before entering credentials.