app[.]trezoriosstart[.]com

This domain, app.trezoriosstart.com, poses a direct threat to users of Trezor hardware wallets by impersonating the official Trezor.io/Start setup page. The site is designed to deceive visitors into entering sensitive recovery seed phrases or private keys under the false pretense of wallet initialization. Such credentials, once captured, grant attackers full access to cryptocurrency holdings, enabling immediate and irreversible theft. The page title, 'Trezor.io/Start | Trezor Hardware Wallet (Official)', is crafted to mimic legitimacy, exploiting user trust in the Trezor brand during critical setup processes. Analysis indicates this domain was registered on May 22, 2025, through Dynadot LLC, a registrar frequently abused for malicious infrastructure. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which provides anonymity and resilience to takedown efforts. The SSL certificate, issued by Google Trust Services (WE1), further lends a false sense of security. Security vendors on VirusTotal flagged this domain as malicious, with 19 out of 95 engines detecting it as a phishing site. Additionally, the domain appears on one security blocklist, confirming its classification as a confirmed threat rather than a false positive. Users who visited app.trezoriosstart.com should assume their recovery seed or private key has been compromised. Immediately cease all interactions with the site and disconnect any hardware wallets connected during the visit. Transfer all cryptocurrency assets to a new, secure wallet using a trusted device and a verified official Trezor setup page. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actors behind this infrastructure.