global-bridgelive[.]wixstudio[.]com

This domain is flagged for elevated-risk brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The site masquerades as an official Trezor Bridge application, a tactic commonly used to distribute crypto drainers or harvest credentials under false pretenses. Analysis indicates the threat type aligns with phishing campaigns designed to exploit trust in legitimate cryptocurrency infrastructure, potentially leading to unauthorized access or asset theft. Infrastructure analysis reveals the domain resolves to IP address 34.144.206.118 and is hosted on a platform utilizing Wix, React, Google Cloud, and Google Cloud CDN technologies. The SSL certificate is issued by Let's Encrypt, a common but non-exclusive indicator in phishing operations. The domain appears on three security blocklists (PhishDestroy, PhishingArmy, OISD) and is flagged by 4 out of 95 security vendors on VirusTotal. Registration details confirm the domain was provisioned through GoDaddy.com, LLC, a widely used registrar that does not inherently indicate malicious intent but is frequently leveraged in impersonation schemes. The page title, 'Trézor Bridge® | Introducing the New Trezor® App,' directly mimics Trezor’s branding, including the use of registered trademark symbols to enhance legitimacy. Mitigation steps specific to this threat type include immediate blocking of the domain and its resolving IP (34.144.206.118) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, including the domain, IP, and associated SSL certificate fingerprint. Users who may have interacted with the domain should revoke any connected wallet permissions, rotate credentials for associated accounts, and monitor transaction logs for unauthorized activity. Security teams are advised to audit logs for connections to 34.144.206.118 or requests to the domain, particularly within cryptocurrency-related workflows. Given the offline status, further monitoring of the IP and registrar activity is recommended to identify potential re-emergence or related domains.