start-terezor[.]pages[.]dev

The domain start-terezor.pages.dev was registered on March 24, 2026 and is currently offline. Technical analysis shows that the domain resolves to IP address 188.114.97.3, which is assigned to Cloudflare, Inc. and geolocated to Canada. The site presented an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain despite the malicious intent. An HTTP request to the domain returns a 403 status code, which suggests that the server is actively refusing access, consistent with a takedown or temporary shutdown. The page title observed before the shutdown was "Trezor Suite Wallet | Step‑by‑Step Hardware Wallet Setup," directly referencing the Trezor brand and confirming a crypto‑related impersonation campaign.

VirusTotal scans recorded 15 detections out of 94 security vendors, providing independent confirmation of malicious classification. The Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist, further indicating low trust. It is listed as blocked by the PhishDestroy service, and the registrar records show the domain was registered through Cloudflare, Inc., using the nameservers cameron.ns.cloudflare.com and crystal.ns.cloudflare.com. Detected technologies include HSTS, Cloudflare edge services, and HTTP/3 support.

The evidence points to a brand‑impersonation crypto scam targeting Trezor users, likely designed to harvest credentials or lure victims into fraudulent wallet interactions. Uncertainty remains regarding the full extent of the infrastructure, such as additional hosting, command‑and‑control servers, or related phishing pages, because the site is no longer reachable for deeper content analysis. Defenders should immediately block start‑terezor.pages.dev at DNS and firewall layers, monitor traffic to the associated Cloudflare IP range for similar patterns, and add the domain to internal threat intel feeds.