web-support-trzr[.]pages[.]dev

This domain, web-support-trzr.pages.dev, is identified as an active brand impersonation threat targeting Trezor, a hardware cryptocurrency wallet provider. The site mimics the official Trezor.io/Start setup page, designed to deceive users into entering sensitive recovery phrases or private keys during what appears to be a legitimate wallet initialization process. Analysis indicates this constitutes a high-risk credential harvesting and cryptocurrency theft operation. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on June 15, 2026, and currently resolves to the IP address 188.114.97.3. Detection metrics show the domain is flagged by 9 of 95 security vendors on VirusTotal, with additional listings on three independent security blocklists. The SSL certificate is issued by Google Trust Services under the WE1 intermediate authority, a common tactic to lend false legitimacy to malicious endpoints. The page title, 'Trezor.io/Start – Set Up Your Trezor Hardware Wallet,' precisely mirrors the official onboarding flow, increasing the likelihood of successful deception. Current status confirms the domain remains active and accessible. Users encountering this domain are advised to immediately cease interaction and report the URL to relevant abuse channels. Organizations should update endpoint protection rules to block 188.114.97.3 and monitor for connections to the domain across network logs. Cryptocurrency wallet users are strongly recommended to verify domain authenticity via official sources before entering sensitive information, particularly during device setup procedures. No legitimate wallet initialization process requires seed phrase entry on a web interface.