io--start---trezzzr[.]pages[.]dev

The domain io--start---trezzzr.pages.dev was identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to mimic the official Trezor setup portal, as evidenced by the page title "Trezor.io/start: Secure Step-by-Step Guide to Trezor Wallet Setup." The domain is currently offline, but prior activity suggests malicious intent to harvest credentials or distribute malicious payloads under the guise of legitimate wallet setup instructions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on June 15, 2026, and resolved to the IP address 172.66.44.148. Security vendors flagged the domain in 13 of 95 VirusTotal scans, and it appears on three security blocklists. The domain was blocked by multiple security mechanisms, including MetaMask, PhishDestroy, and SEAL. The SSL certificate was issued by Google Trust Services, and technologies such as HSTS, Cloudflare, and HTTP/3 were detected. A trust score of 0/100 further corroborates the malicious classification. The domain has been taken offline, but similar threats may persist. Organizations and users are advised to block the domain and associated IP address (172.66.44.148) at the network level. Security teams should monitor for related indicators, including the unique seed c65472, and update detection rules to include the domain and its infrastructure. Users should verify the authenticity of any Trezor-related communications by accessing the official website directly and avoiding links from untrusted sources.