trezor-io-start-cdn[.]pages[.]dev

The domain trezor-io-start-cdn.pages.dev is a phishing site engaged in brand impersonation targeting Ethereum users. It presents itself as a legitimate Trezor wallet setup guide but is designed to harvest sensitive information such as seed phrases or private keys, a tactic known as seed phishing. No active drainer kit was identified, and the site is currently taken offline, though it previously posed an elevated risk to visitors.

Technical indicators confirm the domain's malicious intent. trezor-io-start-cdn.pages.dev was flagged by 1 of 95 VirusTotal security vendors, including Trustwave, and appears on 1 security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on February 21, 2026, it resolved to the IP address 188.114.97.3, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Trezor.io/Start Wallet Guide – Secure Bitcoin & Ethereum'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. Google Safe Browsing did not flag the domain at the time of assessment.

Victims of trezor-io-start-cdn.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If seed phrases or private keys were exposed, consider the compromised wallet permanently unsafe. Change passwords for any accounts accessed on the same device, enable two-factor authentication (2FA), and monitor for unauthorized transactions. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Trezor/Ethereum) to aid in takedown efforts.