trezur-io-start[.]pages[.]dev

Analysis of the domain trezur-io-start.pages.dev indicates an active, high‑risk brand impersonation campaign targeting Trezor users. The site was registered on April 19, 2026 and resolves to IP 188.114.96.3, which is associated with Cloudflare, Inc. in Canada. Infrastructure details show the domain is served through Cloudflare nameservers (lynn.ns.cloudflare.com, nola.ns.cloudflare.com) and employs HSTS, HTTP/3, and an SSL certificate issued by Google Trust Services / WE1. Google Safe Browsing flags the URL for SOCIAL_ENGINEERING, and VirusTotal reports 18 of 94 security vendors flagging the domain. The page title, "Trezor.io/start Guide – Secure Your Crypto Assets with Step‑By‑Step Wallet Setup," aligns with the declared brand target of Trezor. The domain appears on one security blocklist and is blocked by PhishDestroy; Gridinsoft assigns a trust score of 0/100. While the exact page content has not been examined, the combination of brand‑specific title, high‑risk classification, and multiple security detections suggests a deliberate attempt to deceive Trezor users. Defenders should add trezur-io-start.pages.dev to URL filtering and sinkhole lists, monitor for related DNS queries, and alert end‑users to avoid any unsolicited prompts referencing Trezor wallet setup. Continuous observation is recommended to detect any changes in hosting or payload delivery.