add-money-trezor-wallet[.]vercel[.]app

This domain is an active brand impersonation threat designed to deceive users of Trezor hardware wallets. The site mimics the official Trezor setup process, presenting itself as a legitimate onboarding page for new device activation. Visitors are likely prompted to enter sensitive wallet recovery phrases, private keys, or other authentication credentials, which are then harvested by threat actors to gain unauthorized access to cryptocurrency holdings. The page title, 'Trézor.io/Start® | Starting Up Your Device - Trézor®,' closely mirrors the official branding to increase credibility and lower user suspicion during the attack sequence. Analysis indicates the domain was registered on March 08, 2026, through Vercel Inc., a platform commonly used for hosting both legitimate and malicious web applications. Infrastructure review shows the site is currently active and resolves to IP address 64.29.17.195, hosted on Amazon.com, Inc. infrastructure (AS16509). Detection data from VirusTotal reveals that 20 out of 95 security vendors have flagged this domain as malicious, and it appears on three independent security blocklists, including those maintained by cryptocurrency security and anti-phishing organizations. If this domain was visited or interacted with, immediate action is required. Disconnect the device from the network to prevent ongoing data exfiltration. Do not enter any credentials, recovery seeds, or private keys. Reset the Trezor device using the official firmware and generate a new recovery seed. Monitor all associated wallet addresses for unauthorized transactions and consider transferring assets to a new, secure wallet. Report the incident to the official support channel of the targeted brand and submit the domain to additional threat intelligence platforms to assist in broader detection and takedown efforts.