started-trezncdn[.]wixstudio[.]com

This domain, started-trezncdn.wixstudio.com, is identified as a fraudulent crypto wallet setup page specifically designed to impersonate Trezor, a legitimate hardware wallet provider. The site presents itself as an official onboarding portal for Trezor devices, likely aiming to harvest recovery seeds, private keys, or credentials from unsuspecting users under the guise of device initialization. Analysis indicates the domain is currently offline, though prior activity suggests it operated as a crypto drainer, a threat type that directly targets cryptocurrency assets by tricking users into exposing sensitive wallet information. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC, and resolved to the IP address 34.144.206.118, hosted on Google Cloud infrastructure with content delivery via Google Cloud CDN. The site employed an SSL certificate issued by Let’s Encrypt, a common tactic among phishing domains to appear legitimate. Detection metrics show the domain was flagged by 7 of 95 security vendors on VirusTotal, and it appeared on at least one security blocklist. The page title, "Getting™ Started | Trézor.io/Start®®®," closely mimics the official Trezor branding, including typographical elements to enhance credibility. Technologies detected on the site include Wix as the hosting platform, React for frontend development, and HTTP/3 for network communication, indicating a modern, albeit malicious, web presence. Current status confirms the domain has been taken offline, reducing immediate risk to users. However, the infrastructure and techniques observed suggest the threat actor may redeploy similar domains or shift to alternative hosting. Users who accessed the site prior to its removal should assume potential exposure of sensitive wallet information and take immediate action: revoke any associated wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations and security teams are advised to block the domain and associated IP address in network security controls, and to monitor for newly registered domains employing similar naming conventions or impersonating Trezor branding. Proactive measures, including user education on verifying official domain structures and multi-factor authentication for wallet access, are strongly recommended to mitigate future risks.