io-started-terzo[.]pages[.]dev

This domain, io-started-terzo.pages.dev, poses a significant threat as a fraudulent crypto wallet setup portal impersonating the official Trézor.io/Start page. Visitors are likely to encounter a counterfeit interface designed to harvest wallet recovery phrases or private keys, enabling attackers to drain cryptocurrency assets from connected wallets. The site specifically targets users attempting to initialize or recover a Trézor hardware wallet, exploiting trust in the legitimate brand to facilitate unauthorized access to sensitive credentials. Analysis indicates the domain is hosted on Cloudflare infrastructure, resolving to the IP address 172.66.44.141, and is registered through Cloudflare, Inc. The site employs HTTP/3 and HSTS, which may lend an appearance of legitimacy, but these technologies do not mitigate the underlying fraudulent intent. Security vendors have flagged the domain, with 2 out of 95 engines on VirusTotal detecting malicious activity. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms, including PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by Google Trust Services, further obscuring its malicious nature behind seemingly valid encryption. If a user has visited io-started-terzo.pages.dev or entered any sensitive information, immediate action is required. First, disconnect the device from the internet to prevent further data transmission. Do not interact with any prompts or download any software from the site. If wallet credentials or recovery phrases were entered, assume the wallet is compromised and transfer all assets to a new, secure wallet immediately. Monitor all connected accounts for unauthorized transactions and enable additional security measures such as multi-factor authentication where available. Report the incident to relevant security teams and consider notifying the legitimate service provider to aid in takedown efforts.