trezor-support[.]vercel[.]app

This domain poses a high-risk brand impersonation threat targeting Trezor hardware wallet users. The site mimics the official Trezor onboarding process, presenting a fraudulent page titled 'Trézor.io/Start® | Starting Up Your Device - Trézor®' to deceive visitors into entering sensitive recovery phrases or private keys. Such attacks typically lead to immediate unauthorized access to cryptocurrency wallets, resulting in irreversible fund theft. The domain is designed to exploit user trust in the Trezor brand, particularly during initial device setup when users are most vulnerable to guidance from seemingly legitimate sources. Analysis indicates this domain was registered on March 08, 2026, through Vercel Inc., and currently resolves to the IP address 216.198.79.195, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). Security vendors have flagged this domain as malicious, with 20 out of 95 engines on VirusTotal detecting it as a threat. The site appears on three security blocklists, including PhishDestroy and MetaMask, and is actively blocked by multiple threat intelligence platforms. The SSL certificate, issued by Google Trust Services (WR1), does not mitigate the risk, as fraudulent domains frequently use valid certificates to appear legitimate. If you visited trezor-support.vercel.app or entered any sensitive information, immediate action is required. Disconnect the affected device from the internet to prevent further data transmission. Do not use the compromised recovery phrase or private key for any transactions. Generate a new wallet using an official Trezor device or verified software, and transfer all remaining funds to the new wallet address. Monitor all linked accounts for unauthorized activity and consider reporting the incident to relevant security teams or law enforcement. Always verify domain authenticity by cross-referencing with official sources before entering credentials or recovery information.