io-trezr-stra[.]pages[.]dev

This domain io-trezr-stra.pages.dev was registered on March 30 2026 and currently resolves to IP address 172.66.44.148. Infrastructure analysis reveals use of HSTS along with HTTP/3. The domain presents a page titled Trezor Start™ | Official Access to Secure Wallet Setup and targets the Trezor brand through direct impersonation. Registration occurred via Cloudflare Inc while the certificate was issued under Google Trust Services. One security blocklist contains the domain and a trust score of 0/100 has been assigned by an external scanner. VirusTotal reports detections from exactly 1 out of 95 vendors. The domain remains active as of July 12 2026.

The observable indicators confirm brand impersonation through the combination of the page title and the explicit target listed in intelligence records. The creation date precedes the report date by approximately three and a half months placing the domain within a timeframe that permits extended operational use. IP resolution and protocol support remain consistent with active hosting. No contradictory data appears in the provided records regarding these technical attributes.

Uncertainty remains around the exact payload delivered to visitors and the duration of any prior undetected operation before the first blocklist entry. The single vendor flag on VirusTotal and the solitary blocklist appearance indicate limited but existing external validation rather than widespread consensus. Defenders should treat the domain as high risk based on the documented impersonation and active status.

Recommended actions include immediate blocking of io-trezr-stra.pages.dev at network and endpoint levels. Organizations should monitor for similar domains that combine the observed page title patterns with the same IP range or certificate authority. Regular revalidation of the domain status is advised given its confirmed active resolution and continued presence on at least one blocklist.