terzerr-wallet[.]vercel[.]app

This domain is flagged as an elevated-risk brand impersonation threat targeting Trezor hardware wallet users. The site mimics the official Trezor device initialization process, presenting a fraudulent interface designed to harvest cryptocurrency seed phrases and private keys under the guise of legitimate setup procedures. Analysis indicates the threat type aligns with crypto drainer tactics, where victims unknowingly authorize transactions or disclose sensitive credentials to malicious actors. Infrastructure analysis reveals the domain terzerr-wallet.vercel.app was registered through Vercel Inc. and resolves to IP address 216.198.79.131, hosted on Amazon.com, Inc. infrastructure (AS16509). The SSL certificate is issued by Google Trust Services (WR1), a common practice among phishing sites to appear legitimate. At the time of assessment, the domain appeared on 2 security blocklists and was flagged by 18 out of 95 security vendors on VirusTotal. The page title, "Trézor.io/Start® | Starting Up Your Device - Trézor®," precisely mirrors the branding and structure of Trezor’s official onboarding flow, increasing the likelihood of successful deception. The domain has since been taken offline, though historical records confirm its active exploitation period. Mitigation against this specific threat type requires immediate user education and technical controls. Users should verify domain authenticity by cross-referencing official documentation and ensuring all interactions occur exclusively on the legitimate trezor.io domain. Organizations should implement DNS filtering to block known malicious domains, particularly those hosted on cloud platforms like Vercel, which are frequently abused for short-lived phishing campaigns. Endpoint protection should be configured to detect and alert on attempts to access domains with high-risk indicators, such as those impersonating hardware wallet brands. For individuals who may have interacted with this domain, immediate action is required: cease all transactions, revoke any connected wallet authorizations, and generate new seed phrases on a verified, secure device. Monitoring for unauthorized transactions on associated blockchain addresses is critical to limit financial exposure.