hrdwr-trezor-help[.]gitbook[.]io

This domain is a confirmed brand impersonation threat targeting Trezor hardware wallet users. The site presents itself as an official Trezor support or wallet interface, likely designed to trick visitors into entering sensitive recovery phrases, private keys, or other authentication credentials. Such attacks typically aim to drain cryptocurrency wallets or gain unauthorized access to user funds by exploiting trust in the legitimate brand. Analysis indicates the domain was created on June 15, 2026, and registered through Cloudflare, Inc. It resolves to the IP address 172.64.147.209 and uses an SSL certificate issued by Google Trust Services. Security vendors on VirusTotal flagged the domain, with 11 out of 95 detecting malicious activity. The page title, "Trezor® Hardware® Wallet® | | Gitbook (official wallet) | web--us," explicitly mimics official branding to deceive users. The domain appears on three security blocklists and has been taken offline, though similar threats may persist. If you visited hrdwr-trezor-help.gitbook.io or entered any sensitive information, immediately disconnect the device from the internet and cease all interactions with the site. Revoke any connected wallet sessions or authorizations granted during the visit. Transfer remaining funds to a new, secure wallet using a trusted device. Monitor accounts for unauthorized transactions and enable additional security measures, such as multi-factor authentication, where available. Report the incident to the legitimate platform for further guidance and consider notifying relevant security communities to prevent further exploitation.