entrysuites[.]wixstudio[.]com

This domain is flagged for brand impersonation targeting users of a hardware wallet management platform. Analysis indicates the site masquerades as the official web application for managing cryptocurrency hardware wallets, specifically displaying the page title 'Official Trezor™ Suite® — Desktop & Web App for Hardware® Wallets.' Such impersonation typically aims to harvest sensitive credentials, recovery phrases, or private keys under the guise of legitimate wallet software, exposing victims to immediate asset theft and long-term account compromise. Infrastructure analysis reveals concrete indicators of malicious activity. The domain is registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118, hosted on infrastructure utilizing Google Cloud and Google Cloud CDN. It appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and fraudulent sites. Technologies detected include Wix as the hosting platform, React for frontend development, and HTTP/3 for network communication, which align with patterns observed in other impersonation campaigns. Users who visited this domain should take immediate corrective actions. Any credentials, recovery phrases, or private keys entered on the site must be considered compromised and should be revoked or migrated to new, secure wallets. Affected systems should undergo a full malware scan to detect potential secondary infections, such as keyloggers or clipboard hijackers, which are frequently deployed in cryptocurrency theft schemes. It is recommended to monitor connected accounts for unauthorized transactions and enable multi-factor authentication where available. If the domain was accessed via a link, the source of that link should be scrutinized for additional threats, and all related communications should be treated as untrustworthy.