starts-trexoscdn[.]wixstudio[.]com

This domain is flagged as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The site mimics the official Trezor device initialization process, presenting a fraudulent page titled 'Trézor.io/Start — Starting Up™ Your Device | Trezor®®.' Such impersonation typically aims to deceive users into exposing recovery seeds, private keys, or installing malicious firmware, leading to unauthorized access and asset theft. Analysis indicates the domain was registered through GoDaddy.com, LLC and resolves to the IP address 34.144.206.118. Technologies detected include Wix, React, Google Cloud, Google Cloud CDN, and HTTP/3, suggesting a hosted infrastructure with modern web delivery capabilities. The SSL certificate is issued by Let’s Encrypt, providing HTTPS encryption. VirusTotal reports 11 out of 95 security vendors flagging this domain as malicious. It appears on three security blocklists and is actively blocked by PhishDestroy, PhishingArmy, and OISD. The domain is currently offline, but historical activity and detection patterns confirm its use in a coordinated impersonation campaign. Mitigation for users who may have interacted with this domain includes immediate disconnection of any Trezor device used during the session and verification of firmware authenticity through the official Trezor.io portal. Users should never enter recovery seeds or private keys into any website, regardless of apparent legitimacy. Organizations should update endpoint protection rules to block the domain and associated IP, and monitor for connections to 34.144.206.118. Security teams are advised to review logs for prior visits to starts-trexoscdn.wixstudio.com and conduct forensic analysis on any systems that accessed the site. If recovery seeds were exposed, users must migrate assets to a new wallet with a fresh seed phrase generated offline.