start-en-trzor[.]pages[.]dev

This report details a malicious domain, start-en-trzor.pages.dev, which poses as an official Trezor hardware wallet setup page. The page title, "Get Started with Trezor.io/Start — Secure Hardware Wallet Setup," indicates the site impersonates the Trezor brand to deceive users into interacting with a fraudulent setup process. The threat is credential theft or cryptocurrency asset compromise through a phishing scheme targeting Trezor customers.

Technical analysis confirms the fraudulent nature of the site. VirusTotal records 17 detections out of 95 security vendors. The domain is registered with Cloudflare, Inc. and hosted on IP address 188.114.97.3 (Canada), also associated with Cloudflare, Inc. The domain was created on 2026-03-24 and uses an SSL certificate issued by Google Trust Services / WE1. The domain was flagged by ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, and CRDF, and is listed on 1 blocklist. The GridinSoft trust rating is 0 out of 100.

The domain is currently offline and carries a high risk score of 78 on the DOM risk assessment. Given the impersonation of a known brand, high detection rate, and low trust score, this site represents a significant threat to users attempting to set up Trezor hardware wallets. The risk level is critical for any user who may have visited the site or entered credentials.