cdn-io--start-en-tre[.]pages[.]dev

This domain is actively impersonating Trezor, a well-known cryptocurrency hardware wallet provider, to deceive users into disclosing sensitive credentials or installing malicious software. Analysis indicates the site mimics Trezor’s official web interface, presenting a fraudulent login portal under the title 'Trezor/io.start® — Connect Your Web3 World Securely™'. Such impersonation is commonly associated with crypto drainer schemes, where attackers trick victims into connecting wallets to malicious smart contracts, leading to unauthorized fund transfers or complete asset loss. Infrastructure analysis reveals concrete indicators of compromise. The domain, registered through Cloudflare, Inc., was created on April 09, 2026, and resolves to the IP address 172.66.47.53, located in Canada. Security vendors have flagged this domain, with VirusTotal reporting 7 out of 95 engines detecting malicious activity. Additionally, the domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1), a common characteristic of attacker-controlled infrastructure leveraging legitimate CDN services to evade detection. Users who have visited cdn-io--start-en-tre.pages.dev or interacted with its content should take immediate action to mitigate risk. Disconnect any wallets linked to the site and revoke permissions via the official wallet interface. Scan the device for malware using updated security tools, and monitor connected accounts for unauthorized transactions. If credentials were entered, reset passwords and enable multi-factor authentication on all critical accounts. Given the high-risk nature of this threat, affected users should also consider migrating assets to a new wallet and reporting the incident to relevant security teams for further investigation.