start-io-trzor-uo[.]pages[.]dev

Analysis of the domain start-io-trzor-uo.pages.dev indicates confirmed phishing activity targeting cryptocurrency wallet users, specifically those associated with Trezor. The domain was registered through Cloudflare Pages on October 11, 2025, and remains active as of July 29, 2026. Infrastructure analysis reveals hosting on Cloudflare's content delivery network, a common tactic for phishing sites to leverage reputable providers for initial credibility.

The domain appears on one security blocklist (PhishDestroy), and 12 of 91 security vendors on VirusTotal have flagged it as malicious, providing technical evidence of its fraudulent nature. The exact content and functionality of the site have not been fully analyzed, but the domain name structure ('trzor') strongly suggests an intent to deceive users attempting to access Trezor's legitimate services. No specific phishing kit or brand impersonation beyond the domain naming convention has been confirmed in the available data.

Defenders should treat this domain as an elevated-risk threat due to its active status, blocklist presence, and vendor detections. Recommended actions include immediate blocking at the network and endpoint levels, monitoring for related domains using similar naming patterns, and alerting users to potential cryptocurrency wallet credential theft risks. Further investigation into associated infrastructure, such as IP addresses or SSL certificates, may provide additional indicators of compromise for threat hunting purposes.