io-trrezor[.]pages[.]dev

This domain represents a high-risk phishing campaign designed to impersonate a widely used hardware wallet interface, specifically targeting users attempting to access their cryptocurrency storage. The site presents a fraudulent login portal titled 'Trezor Login — Secure Access to Your Hardware Wallet,' mimicking the legitimate authentication flow to harvest credentials and recovery seeds. Such attacks typically lead to unauthorized access, asset theft, or deployment of cryptocurrency drainer scripts upon successful compromise of victim credentials. Infrastructure analysis reveals the domain was registered on October 29, 2025, through Cloudflare, Inc., a registrar frequently leveraged by threat actors to obscure hosting origins and evade takedowns. The domain resolves to the IP address 188.114.96.3, associated with autonomous system AS13335 and geolocated in the United States. Detection metrics indicate broad recognition of malicious activity, with 11 out of 95 security engines on VirusTotal flagging the domain as phishing. Additionally, the domain appears on three independent security blocklists, and its SSL certificate, issued by Google Trust Services (WE1), aligns with patterns observed in transient phishing infrastructure. Users who accessed this domain or entered sensitive information are at immediate risk of account compromise and financial loss. Affected individuals should revoke any active sessions, rotate all credentials associated with cryptocurrency accounts, and initiate a full recovery process using official, verified channels. Hardware wallet users are advised to verify domain authenticity through direct navigation to the vendor’s documented URL and enable multi-factor authentication where supported. Monitoring for unauthorized transactions and reporting the incident to relevant security teams is strongly recommended to mitigate further exposure.