help-shs--trezor[.]gitbook[.]io

This domain was identified as a high-risk phishing site impersonating Trezor, a cryptocurrency hardware wallet provider. The site displayed a fraudulent page titled 'Trezor.io/Start® | Starting® Up Your Device,' designed to deceive users into entering sensitive credentials or recovery phrases under the guise of device setup. Such attacks aim to compromise wallet access, leading to unauthorized transactions or complete asset loss. Analysis indicates the domain was registered on June 15, 2026, through Cloudflare, Inc, and resolved to the IP address 172.64.147.209. It was flagged by 17 out of 95 security vendors on VirusTotal, appearing on three security blocklists. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy. The domain was blocked by multiple security tools, including MetaMask and PhishDestroy, further confirming its malicious intent. Users who visited this domain should immediately cease all interaction and assume any entered credentials or recovery phrases are compromised. Disconnect the device from the internet, revoke any connected wallet permissions, and initiate a full security review. If recovery phrases were exposed, transfer assets to a new wallet with a fresh seed phrase. Monitor accounts for unauthorized activity and report the incident to the legitimate service provider for further guidance.