io-startt-faq-trezor-en[.]pages[.]dev

The domain io-startt-faq-trezor-en.pages.dev was registered on February 21, 2026 and is hosted behind Cloudflare’s network (AS13335) at IP address 172.66.44.86. The site serves a page titled "Trezor.io/Start | Starting® Up® Your® Device® — Step‑by‑Step 1500‑word Guide," which directly references the Trezor brand and, by extension, the Ethereum ecosystem, indicating a brand‑impersonation campaign aimed at cryptocurrency users. The HTTPS certificate is issued by Google Trust Services under the WE1 root, confirming a valid TLS handshake, while the presence of HSTS and HTTP/3 suggests a modern web stack. HTTP requests return a 403 status, preventing content retrieval, and the domain is currently offline, as noted by the status flag and its removal from public access.

Reputation services provide a poor risk assessment: Scamadviser assigns a trust score of 41 / 100, Gridinsoft rates the domain at 0 / 100, and two of ninety‑five VirusTotal scanners have flagged the host as malicious. The domain is listed on a single security blocklist and has been actively blocked by PhishDestroy. Nameservers are rachel.ns.cloudflare.com and ram.ns.cloudflare.com, confirming Cloudflare as the registrar.

Given the observed indicators—recent creation, cloud‑based hosting, a brand‑specific page title, low trust scores, and detection by multiple security vendors—the domain should be treated as a high‑confidence impersonation threat. Defensive actions include adding the domain to DNS‑based blocklists, updating web‑gateway filters to deny traffic to the host, and monitoring for similarly structured subdomains that reference Trezor or other crypto‑related brands. Continuous re‑scanning of the domain is advised in case it re‑appears, and analysts should correlate any future activity with known Ethereum‑related phishing campaigns to assess potential credential‑stealing or fund‑exfiltration attempts.