trezorio-start-wallet[.]pages[.]dev

The domain trezorio-start-wallet.pages.dev was a phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It posed an elevated risk as a cryptocurrency scam designed to deceive users into disclosing wallet credentials or sensitive information. No drainer kit was identified, and the site is currently taken offline.

Technical indicators confirm its malicious nature. As of analysis, 2 of 95 VirusTotal security vendors flagged trezorio-start-wallet.pages.dev, including alphaMountain.ai and Fortinet. The domain was registered through Cloudflare, Inc. on September 09, 2025, and resolved to the IP address 172.66.45.46, hosted by Cloudflare in the US. It appeared on one security blocklist (PhishDestroy) and was not flagged by Google Safe Browsing. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 at the time of assessment. Gridinsoft assigned a trust score of 0/100, while Scamadviser rated it 41/100.

Users who interacted with trezorio-start-wallet.pages.dev should immediately revoke any token approvals and transfer cryptocurrency funds to a new wallet. Change passwords for any accounts accessed via the phishing site and enable two-factor authentication (2FA) where available. Monitor accounts for unauthorized transactions and report the domain to relevant platforms, including the impersonated brand (Trezor), Cloudflare’s abuse team, and security blocklists such as PhishTank or Google Safe Browsing.