setup-trzor-io[.]pages[.]dev

This domain, setup-trzor-io.pages.dev, poses a high-risk credential phishing threat targeting cryptocurrency wallet users. The site impersonates the official setup portal of a well-known hardware wallet provider, using an identical page title and branding to deceive visitors into entering sensitive recovery phrases or private keys. Analysis indicates the fraudulent page is designed to harvest cryptographic credentials, enabling attackers to gain unauthorized access to victims' digital assets and transfer funds without consent. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain is flagged by 3 out of 95 security vendors on VirusTotal, including specialized cryptocurrency security tools. It appears on three security blocklists and is actively blocked by wallet protection systems. The domain is registered through Cloudflare, Inc., leveraging Cloudflare Pages hosting, and resolves to the IP address 188.114.96.3. Despite the use of a valid SSL certificate issued by Google Trust Services, the Gridinsoft trust score remains at 0/100, further confirming its fraudulent nature. Users who have visited setup-trzor-io.pages.dev should immediately cease all interaction with the site. If any sensitive information, such as recovery phrases or private keys, was entered, affected wallets should be considered compromised. Users are advised to transfer remaining assets to a new, secure wallet using an unaffected device. Enable multi-factor authentication on all cryptocurrency-related accounts and monitor transaction histories for unauthorized activity. Report the incident to relevant security teams and consider filing a complaint with local cybercrime authorities. Always verify domain authenticity by cross-referencing official sources before entering credentials.