discover-bridgeapp[.]wixstudio[.]com

This domain, discover-bridgeapp.wixstudio.com, is identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The site masquerades as an official Trezor Bridge download portal, presenting itself under the title "Official Trézor® Bridge| Introducing the New Trezor®." Analysis indicates the domain is currently offline, though prior activity suggests intent to distribute malicious payloads or harvest credentials from unsuspecting users. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118. It is flagged by 10 of 95 security vendors on VirusTotal, with additional detections across three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate is issued by Let's Encrypt, and the site employs technologies such as Wix, React, Google Cloud, Lodash, HSTS, Google Cloud CDN, and HTTP/3. No creation date is publicly available, but the domain's infrastructure and hosting patterns align with known malicious campaigns targeting cryptocurrency users. The domain has been taken offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar impersonation attempts. It is recommended to block the domain and associated IP address (34.144.206.118) at the network level, update endpoint protection rules to include this indicator, and monitor for recurring infrastructure reuse under different subdomains or aliases. Users should verify all Trezor-related downloads exclusively through the official trezor.io domain and enable multi-factor authentication on all cryptocurrency-related accounts.