trezor-io[.]start-us[.]workers[.]dev

PhishDestroy identifies trezor-io.start-us.workers.dev as an active domain engaged in brand impersonation targeting Trezor users. This domain poses a HIGH RISK due to its specific intent to deceive victims into entering sensitive credentials or transferring cryptocurrency to attacker-controlled wallets. The threat is classified as a crypto drainer impersonation scam, leveraging Trezor’s brand recognition to exploit user trust. Given the domain’s active status and lack of detection on VirusTotal, users are strongly advised to exercise extreme caution and verify the legitimacy of this domain before any interaction.

This domain was flagged with the following technical indicators: it resolves to IP address 188.114.97.3, is registered through Cloudflare, Inc., and utilizes a Let’s Encrypt SSL certificate for added legitimacy. VirusTotal currently reports 0 detections out of 95 scanners, indicating that traditional security tools have not yet flagged this domain. The domain is hosted on Cloudflare Workers, a legitimate service often abused by threat actors to host phishing pages due to its low barrier to entry and high availability. The lack of detections and the use of a reputable hosting provider highlight the sophistication of this campaign, which relies on brand impersonation rather than overtly malicious infrastructure.

To mitigate risk, users should immediately cease all interactions with trezor-io.start-us.workers.dev and avoid entering any credentials or cryptocurrency wallet information. Verify the domain’s legitimacy by cross-referencing official Trezor channels or using PhishDestroy’s verification tools. If any interaction has already occurred, users should revoke any exposed API keys, rotate wallet credentials, and monitor accounts for unauthorized transactions. Organizations should block this domain at the network level and update threat intelligence feeds to include this indicator. Proactive user education on recognizing impersonation scams is critical to preventing further victimization.