start-trzrios[.]pages[.]dev

This domain, start-trzrios.pages.dev, is actively impersonating Trezor, a hardware cryptocurrency wallet provider, as indicated by its page title 'Trezor Start™ | Official Trezor® Portal for Safe Wallet Setup' and confirmed brand target in threat intelligence. Registered on March 30, 2026, the domain resolves to IP 172.66.47.64, hosted on Cloudflare infrastructure with nameservers boyd.ns.cloudflare.com and brenna.ns.cloudflare.com, both associated with Cloudflare, Inc. The domain currently returns an HTTP 200 status, signaling an operational phishing endpoint, and employs HSTS and HTTP/3 technologies, alongside a Google Trust Services SSL certificate (WE1). Analysis reveals the domain is flagged by one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further indicating high risk. VirusTotal reports 10 of 94 security vendors detect the domain as malicious, though this count reflects only a subset of available detection engines and should not be interpreted as exhaustive. The domain's infrastructure, including its use of Cloudflare and a recent registration date, aligns with patterns observed in brand impersonation campaigns targeting cryptocurrency users. Defenders should treat this domain as an active threat. The combination of a spoofed brand, operational status, and security vendor detections provides sufficient evidence to classify it as high-risk. No additional content analysis has been conducted, so the exact mechanics of the phishing kit remain unconfirmed. Network-level blocking and monitoring for connections to 172.66.47.64 or the domain itself are recommended to mitigate exposure.