trezor-io-start-abs[.]pages[.]dev

The domain trezor-io-start-abs.pages.dev was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.47.91, which is associated with ASN 13335 located in the United States. The site presents the page title “Suspected phishing site | Cloudflare” and returns an HTTP 403 status, indicating that the content is blocked at the web server level. Security instrumentation shows a Google Trust Services / WE1 SSL certificate covering the host, with HSTS and HTTP/3 enabled, confirming the use of modern Cloudflare services. The domain’s Gridinsoft trust score is 0 out of 100, reflecting a worst‑case rating.

VirusTotal analysis recorded a single positive detection out of 93 scanning engines, and the domain is listed on one public security blocklist. PhishDestroy has also added the host to its block list, and the overall status is currently offline. The observed indicators – a Cloudflare‑hosted sub‑domain, a page title explicitly warning of phishing, and the association with a known brand target (Trezor) – align with the classification of a crypto‑related brand‑impersonation campaign. No further evidence of payload delivery, credential‑stealing forms, or additional infrastructure has been disclosed.

Defenders should continue to block the domain at network perimeter devices, monitor for DNS queries to the host, and correlate any attempted connections with the listed IP address. Threat‑intel teams may want to enrich the single VirusTotal detection by reviewing the vendor that flagged the domain and assess whether the underlying malicious kit corresponds to known Trezor‑targeted phishing modules. Ongoing observation is advised in case the site is re‑hosted or the perpetrators shift to a new domain.