io-start-trzr-pages[.]pages[.]dev

Analysis of the domain io-start-trzr-pages.pages.dev shows a clear case of brand impersonation targeting the Trezor hardware‑wallet brand. The site was registered on March 22, 2026 and is hosted behind Cloudflare, resolving to the IP address 188.114.96.3, which is geolocated to Canada and belongs to Cloudflare, Inc. The domain uses Cloudflare‑provided services, including HSTS enforcement and HTTP/3, and presents a Google Trust Services WE1 SSL certificate, indicating that TLS negotiation is functional despite the malicious intent. An HTTP request to the site returned a 403 status code, and the page title captured from the endpoint reads "Trezor® Hardware Wallet | Secure Your Bitcoin," directly referencing the targeted brand and suggesting a crypto‑scam motive.

The site’s trust score from Gridinsoft is 0 / 100, reflecting extreme risk. VirusTotal scans show that nine out of ninety‑four security vendors flagged the domain, and the domain appears on a single known security blocklist. PhishDestroy has already taken the domain offline, and the current status is listed as offline.

While the available data confirm the impersonation and the association with a crypto‑scam, no detailed content analysis or payload information is present, leaving the exact phishing workflow uncertain. Defenders should continue to block the domain and its associated IP at network perimeter devices, update URL filtering and threat‑intel feeds with the domain and IP, and monitor for any re‑registration attempts that reuse the same naming pattern. Continuous observation of Cloudflare name‑server changes and periodic re‑scanning of the IP for emerging threats are recommended to maintain coverage against potential reuse.