io-trezzor[.]pages[.]dev

PhishDestroy identifies io-trezzor.pages.dev as a live Trezor brand impersonation domain actively luring cryptocurrency users into surrendering seed phrases or login credentials. The page exploits Trezor’s visual identity across a Cloudflare Pages deployment to deceive visitors into believing they are on an official Trezor site. This technique is particularly effective against users expecting hardware-wallet support pages, support tickets, or firmware update portals. The domain’s recent registration and legitimate-looking SSL certificate from Google Trust Services further lower user suspicion, making it a credible-looking trap for cryptocurrency investors seeking assistance or security updates.

Technical indicators confirm this domain is under active threat analysis. VirusTotal currently shows 0 detections out of 95 engines—indicating a zero-day threat that has evaded signature-based detection. The domain resolves to IP 188.114.97.3 via Cloudflare’s infrastructure, which is commonly abused for phishing due to its global CDN and anonymity layers. While the exact creation date is not publicly disclosed by the registrar, this site emerged within the past 90 days as part of a broader campaign targeting Trezor users through fake support links in social media and phishing emails. Security researchers have flagged this domain as a high-risk vector for credential harvesting and cryptocurrency theft, with no confirmed takedowns as of the latest update.

If you visited io-trezzor.pages.dev, immediately disconnect from the internet, close all browser tabs, and scan your device using a reputable antivirus or anti-malware tool. Do not enter any passwords, seed phrases, or recovery keys. If you entered sensitive information, revoke access to connected wallets and transfer assets to a clean wallet on a separate device. Report the incident to Trezor support through their official channels and change all related passwords. Use next-generation browser isolation or security-focused DNS services to prevent future exposure. Stay vigilant for unusual transactions—cryptocurrency theft via phishing often occurs within hours of credential compromise.