suitapp-ensite[.]wixstudio[.]com

This domain, suitapp-ensite.wixstudio.com, is identified as a brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site masquerades as the official Trezor Suite desktop application, presenting a page titled 'Official Trezor™ Suite — Desktop' to deceive users into entering sensitive credentials or downloading malicious software. The infrastructure leverages Wix hosting, with additional technologies including React, Google Cloud CDN, and RequireJS, which are consistent with modern phishing frameworks designed to evade basic detection mechanisms. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on June 11, 2026, though this date may reflect a falsified record or a placeholder. It resolves to the IP address 34.144.206.118, hosted on Google Cloud infrastructure, and employs a Let's Encrypt SSL certificate to simulate legitimacy. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD, and is flagged by 7 out of 95 security vendors on VirusTotal. No Google Safe Browsing (GSB) status is currently available, but the elevated detection count suggests active malicious intent. As of the latest assessment, suitapp-ensite.wixstudio.com has been taken offline, likely due to hosting provider intervention or registrar enforcement. However, the risk of reemergence remains elevated, particularly if the threat actors retain access to the registration details or associated infrastructure. Users who interacted with the domain are advised to revoke any credentials or wallet access permissions, monitor for unauthorized transactions, and verify the authenticity of any Trezor-related software through official channels. Organizations should update blocklists to include the domain and IP address to prevent future exposure.