startsso-treziouth[.]wixstudio[.]com

Analysis of startsso-treziouth.wixstudio.com shows a domain registered through GoDaddy.com, LLC on 17 December 2016. The site currently returns HTTP 404 and is reported offline, with the page title “Trézor.io/Start — Starting Up™ Your Device | Trezor”. Although the title references the Trezor brand, the intelligence flags the domain as a brand‑impersonation campaign targeting Google. Four of ninety‑one VirusTotal scanners have flagged the domain, and it appears on a single external blocklist. The domain resolves to 34.144.206.118, an address announced by AS396982 Google LLC in the United States, and is served behind Google Cloud services, including Cloud CDN and HTTP/3.

The TLS certificate is a Let’s Encrypt R13 issuance, providing encryption but no authentication of the underlying operator. Hosting infrastructure is built on Wix and uses React, Lodash, and HSTS. Nameservers are dns1‑dns4.p08.nsone.net. The domain has been blocked by PhishDestroy.

The limited detection count and single blocklist entry suggest a low‑profile or short‑lived campaign, but the combination of a legacy registration date, brand‑impersonation label, and use of reputable cloud resources indicates a potential abuse vector. Content of the landing page has not been captured, so the exact phishing lures and credential‑collection mechanisms remain unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑hosting or resurrection of the host, and consider adding the IP address to threat‑intel feeds. Additional scanning of related Wixstudio subdomains and monitoring of new registrations that reference “Trézor” or Google‑related keywords is advised to catch future iterations.