io-trezo-web[.]pages[.]dev

This domain, io-trezo-web.pages.dev, is identified as a brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. The page mimics Trezor’s official onboarding process, presenting itself as 'Trezor.io/start - Secure Your Crypto' to deceive users into entering sensitive credentials, recovery seeds, or installing malicious software. Such impersonation typically aims to harvest cryptocurrency wallet access or distribute malware under the guise of legitimate security procedures. The threat is classified as social engineering, exploiting trust in the Trezor brand to manipulate victims into compromising their digital assets. Analysis of the domain’s infrastructure reveals multiple indicators of malicious intent. The domain resolves to the IP address 188.114.96.3 and was registered on April 04, 2026, through Cloudflare, Inc., a common registrar for both legitimate and malicious sites. Despite its recent creation, the domain has already been flagged by one security blocklist, specifically PhishDestroy. VirusTotal reports 0 out of 95 detections, indicating it has not yet been widely recognized by security vendors, though Google Safe Browsing has classified it under 'SOCIAL_ENGINEERING.' The SSL certificate is issued by Google Trust Services, which provides a false sense of security to users. The Gridinsoft trust score of 0 out of 100 further underscores the domain’s high-risk nature. Users who visited io-trezo-web.pages.dev should take immediate action to mitigate potential risks. If any credentials, recovery phrases, or personal information were entered, they must assume compromise and revoke access to all associated cryptocurrency wallets. It is critical to monitor accounts for unauthorized transactions and consider transferring assets to a new, secure wallet. Additionally, users should scan their devices for malware, as the site may have attempted to deliver malicious payloads. To prevent future incidents, individuals are advised to verify the authenticity of any website by cross-referencing the domain with the official Trezor site and using only trusted links from verified sources. Bookmarking the legitimate Trezor.io domain can help avoid falling victim to similar impersonation attacks.