starttezor[.]pages[.]dev

This domain, starttezor.pages.dev, poses a high-risk brand impersonation threat targeting users of Trezor, a cryptocurrency hardware wallet. The page is designed to deceive visitors into believing they are accessing the official Trezor setup portal, as indicated by its page title: 'Official Site® | Trezor.io/Start — Official Getting Started With Trezor.' Such impersonation domains are commonly used to harvest sensitive information, distribute malware, or facilitate cryptocurrency theft by tricking users into entering recovery seeds, private keys, or other credentials into fraudulent interfaces. Analysis of the domain reveals multiple technical indicators confirming its malicious nature. The domain is flagged by 16 out of 95 security vendors on VirusTotal, and it appears on three independent security blocklists. It is hosted via Cloudflare, resolving to the IP address 172.66.47.197, and uses an SSL certificate issued by Google Trust Services. The domain was registered on June 15, 2024, a recent creation date that aligns with typical phishing campaign timelines. Additionally, it is blocked by MetaMask, PhishDestroy, and SEAL, further corroborating its malicious classification. The use of HSTS and HTTP/3 technologies does not mitigate the risk, as these are standard features of Cloudflare-hosted domains and do not indicate legitimacy. Users who have visited starttezor.pages.dev or interacted with its content should take immediate action to mitigate potential risks. Disconnect any devices that accessed the domain from the internet and cease all further interaction with the site. If any credentials, recovery seeds, or private keys were entered, assume they are compromised and initiate recovery procedures for all associated cryptocurrency wallets. Monitor accounts for unauthorized transactions and consider revoking access to any connected applications or services. Report the domain to relevant security teams or platforms to aid in broader threat mitigation efforts. Regularly update security tools and verify domain authenticity before entering sensitive information on any cryptocurrency-related websites.