trexor-suitte[.]wixstudio[.]com

The domain trexor-suitte.wixstudio.com was identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis confirms this domain mimicked the official Trezor Suite desktop application, likely aiming to harvest user credentials or distribute malicious software under the guise of legitimate wallet management tools. The page title explicitly displayed "Trezor Suite — Desktop," reinforcing the deception. Infrastructure analysis reveals the domain was flagged by 16 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through GoDaddy.com, LLC on June 11, 2026, and resolved to the IP address 34.144.206.118. The domain appeared on three security blocklists, including PhishDestroy and PhishingArmy, and was blocked by OISD. Technologies detected include Wix hosting, React, Google Cloud CDN, and HTTP/3, with a Let's Encrypt SSL certificate providing HTTPS encryption. The creation date discrepancy (2026) suggests potential domain spoofing or incorrect registration records. As of the latest assessment, trexor-suitte.wixstudio.com is offline, reducing immediate risk to users. However, organizations and individuals should remain vigilant for similar impersonation attempts. Recommended actions include blocking the domain and associated IP (34.144.206.118) at the network level, updating endpoint protection rules to flag related indicators, and educating users on verifying official Trezor domains (e.g., trezor.io). Security teams should monitor for resurgence or rebranding of this threat under alternative domains or hosting providers.