connect-trezure-io[.]pages[.]dev

The domain connect-trezure-io.pages.dev is a phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It poses an elevated risk by mimicking Trezor's official setup page to deceive users into entering sensitive wallet credentials or recovery phrases, potentially leading to unauthorized access or fund theft. No drainer kit was identified, and the site is currently taken offline.

Technical indicators confirm its malicious nature: 1 of 95 VirusTotal security vendors (including Trustwave) flagged connect-trezure-io.pages.dev as phishing. The domain was registered through Cloudflare, Inc. on September 10, 2025, and resolves to the IP address 172.66.47.56, hosted on Cloudflare's US-based infrastructure (AS13335). It appears on one security blocklist (PhishDestroy) and uses an SSL certificate issued by Google Trust Services (WE1). The observed page title, 'Trezor.io/start | Official Wallet Setup WalletstartedDevice®UsersManagement,' closely resembles Trezor's legitimate branding. Additional detections include a Gridinsoft trust score of 0/100 and technologies such as HSTS and HTTP/3.

Users who interacted with connect-trezure-io.pages.dev should immediately revoke any token approvals linked to the site and transfer funds to a new, secure wallet. Change passwords for any accounts accessed via the phishing page and enable two-factor authentication where available. Monitor financial and cryptocurrency accounts for unauthorized transactions. Report the domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Trezor) to aid in takedown efforts and prevent further victimization.