trezorrio-start-web[.]pages[.]dev

Analysis of trezorrio-start-web.pages.dev shows a high‑risk brand‑impersonation infrastructure targeting the cryptocurrency hardware wallet brand Trezor. The domain was registered through Cloudflare, Inc. on February 21, 2026 and resolves to the IP address 172.66.44.78, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status, indicating that the content is being blocked at the web server level. TLS termination is provided by a Google Trust Services certificate (WE1), and the site advertises HSTS, Cloudflare services, and HTTP/3 support.

DNS resolution uses the Cloudflare nameservers lloyd.ns.cloudflare.com and paislee.ns.cloudflare.com. Reputation data includes a Gridinsoft trust score of 0 / 100, placement on one security blocklist, and a Google Safe Browsing classification for social engineering. VirusTotal analysis recorded ten detections out of ninety‑three scanning engines, and the domain is listed as blocked by PhishDestroy. The observed indicators collectively confirm that the domain is being used for a crypto‑related scam that impersonates Trezor.

While the page content has not been captured, the combination of registrar metadata, hosting under Cloudflare, low trust scoring, and multiple independent detections provides strong evidence of malicious intent. Defenders should block the domain at network perimeter, add the IP address 172.66.44.78 to deny‑lists, and monitor for any future re‑hosting attempts. Continuous threat‑intel feeds should be consulted for potential re‑use of the same Cloudflare nameservers or similar domain patterns, and users should be warned against any unsolicited communications referencing Trezor that reference this domain or its associated IP.