trezorrecovery[.]app

This domain, trezorrecovery.app, poses a severe threat to cryptocurrency users by impersonating Trezor, a trusted hardware wallet provider. The site is designed to trick visitors into entering their recovery seed phrases or private keys under the guise of official wallet support. Once submitted, these credentials are transmitted to threat actors, enabling the theft of Bitcoin and other cryptocurrencies stored in the compromised wallets. The page title, '- Trezor Hardware-Wallet (Offiziell) | Bitcoin & Krypto-Sicherheit | Trezor,' explicitly mimics Trezor’s branding, targeting German-speaking users with false claims of legitimacy. Analysis indicates this domain was registered on June 8, 2026, through TLD Registrar Solutions Ltd, a registrar frequently associated with fraudulent infrastructure. It resolves to the IP address 82.221.129.44 and has been flagged by 12 out of 95 security vendors on VirusTotal, including MetaMask, PhishDestroy, SEAL, and Hagezi. The domain appears on four security blocklists and has been referenced in two AlienVault OTX threat intelligence pulses, confirming its malicious intent. A Gridinsoft trust score of 0/100 further underscores its high-risk classification. Users who visited trezorrecovery.app should assume their recovery seed or private keys have been compromised. Immediate action is required: transfer all funds from the potentially exposed wallet to a new, secure wallet with a fresh seed phrase. Do not reuse any credentials or keys associated with the compromised wallet. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant cryptocurrency security teams and consider filing a report with local cybercrime authorities. Avoid interacting with any communications or links originating from this domain, as they may contain additional malware or phishing attempts.