io-start--trezor-io[.]pages[.]dev

The domain io-start--trezor-io.pages.dev was registered on June 10, 2026 through the Cloudflare Pages service, indicating that the hosting infrastructure is provided by Cloudflare’s edge network. The domain appears on a single security blocklist and is listed as blocked by PhishDestroy, confirming that at least one anti‑phishing organization has identified it as malicious. VirusTotal analysis shows that 12 of 91 scanned security vendors flagged the domain, providing independent corroboration of its suspicious nature. The threat classification associated with this domain is a crypto drainer, suggesting that the site is designed to illicitly acquire cryptocurrency assets from victims, typically by presenting fraudulent transaction requests or wallet address substitutions.

The elevated risk rating and active status indicate that the infrastructure is currently operational and poses a non‑trivial threat to users who may encounter it. Infrastructure analysis reveals no unique IP address information beyond the Cloudflare front‑end, which limits direct attribution but also offers the attacker resilience through Cloudflare’s distributed architecture. Evidence is limited to the registration date, blocklist presence, and the partial VirusTotal detection count; no additional indicators such as SSL certificate details, HTTP response codes, or page title content have been disclosed.

Consequently, uncertainty remains regarding the specific payload delivery mechanisms, the exact phishing workflow, and any potential command‑and‑control infrastructure. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the domain, and incorporate the observed indicators into threat‑intel feeds. Organizations should also educate users about crypto‑related scams and advise verification of wallet addresses before any transaction, as the domain’s primary objective appears to be unauthorized cryptocurrency extraction.