setup-trzor-io[.]pages[.]dev

setup-trzor-io.pages.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first observed the hostname on Jun 26, 2026. The captured page title is “Trézor.io/Start® | Secure Crypto Wallet & Digital Asset Management”. Current evidence score: 71/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, MetaMask, and SEAL. VirusTotal recorded 7 detections among 91 engines: ChainPatrol, BitDefender, CyRadar, ESET, G-Data, Kaspersky, LevelBlue on Jul 18, 2026 at 20:45 UTC. MetaMask and SEAL listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. Non-positive and contextual checks: Google Safe Browsing returned no flag on Jun 26, 2026 at 14:26 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:02 UTC.

An access-restricted HTTP 403 response was recorded on Aug 7, 2026 at 01:06 UTC. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 188.114.96.3 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The IP and ASN identify shared Cloudflare infrastructure, not the tenant operator. DOM analysis on Jun 26, 2026 at 14:20 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy and URLScan. The platform TLS certificate was issued by Google Trust Services / WE1 with validity through Jul 29, 2026; checked Jun 26, 2026 at 16:00 UTC.

The content indicators and 3 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.