strt-iotrzrr[.]pages[.]dev

PhishDestroy has identified the domain strt-iotrzrr.pages.dev as a generic phishing threat targeting users of the Trezor cryptocurrency hardware wallet. The website's page title, 'Official Site® | Trézor.io/Start® | Get Started with Trézor™', is a clear attempt to impersonate the legitimate Trezor start page and trick users into entering sensitive information. While no specific drainer kit was identified, this type of phishing site typically aims to steal recovery phrases or login credentials.

Technical analysis reveals several key indicators of malicious activity. VirusTotal flagged the domain with a score of 6 out of 95 security vendors, and it appears on at least one security blocklist. The domain was registered through Cloudflare, Inc. and resolved to IP address 188.114.96.3. Its SSL certificate was issued by Google Trust Services / WE1. Importantly, the domain was created on January 20, 2026, which is a future date relative to the current context, suggesting either a data anomaly or an attempt to evade detection. Google Safe Browsing status was not provided, but the blocklist presence confirms malicious activity.

As of the latest check, the domain is offline and has been taken down, likely due to reporting or automated takedown processes. While the immediate threat is neutralized, users who may have interacted with the site before takedown should consider their accounts at risk. PhishDestroy recommends that anyone who visited strt-iotrzrr.pages.dev change their Trezor-related passwords immediately and enable two-factor authentication. Always verify URLs by typing them manually and avoid clicking links in unsolicited messages. Stay vigilant against similar phishing attempts targeting cryptocurrency users.