starts-ioapps-treor[.]wixstudio[.]com

This domain, starts-ioapps-treor.wixstudio.com, poses a brand impersonation threat specifically targeting users of Trezor, a hardware cryptocurrency wallet. The page replicates the official Trezor.io/Start interface, tricking victims into entering recovery seeds or private keys under the guise of device initialization. Such attacks typically lead to unauthorized access to crypto wallets, resulting in asset theft without further user interaction, commonly referred to as a crypto drainer scheme. The page title, 'Trezor.io/Start® — Starting Up Your Device | Trezor®,' is designed to deceive users into believing they are interacting with legitimate Trezor infrastructure. Analysis indicates the domain is flagged by 12 out of 95 security vendors on VirusTotal, signaling broad detection as malicious. Infrastructure analysis reveals the domain resolves to IP address 34.144.206.118, hosted on Google Cloud with a Let's Encrypt SSL certificate, adding a false sense of legitimacy. The domain is registered through GoDaddy.com, LLC and utilizes Wix platform technologies, including React and Google Cloud CDN. It appears on one security blocklist and is currently offline, though prior activity remains a concern. The use of HTTP/3 further suggests an attempt to evade traditional network-based detection mechanisms. Users who visited starts-ioapps-treor.wixstudio.com or entered sensitive information such as recovery seeds or private keys should immediately disconnect the affected device from the internet and cease all transactions. It is critical to transfer remaining assets to a new, secure wallet using a clean device not previously exposed to the malicious domain. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If the Trezor device was connected to a computer during the interaction, assume the system may be compromised and perform a full malware scan or consider reinstalling the operating system. Report the incident to the legitimate Trezor support team for further guidance on securing the wallet.