bridge-en-terezor[.]pages[.]dev

This domain, bridge-en-terezor.pages.dev, is flagged as a brand impersonation phishing site targeting Trezor, a well-known hardware wallet provider. Analysis indicates the page was designed to mimic Trezor’s official infrastructure, presenting itself under the title 'Secure Your Crypto with Trezor Bridge for Hardware Wallets.' The intent appears to be credential harvesting or distribution of malicious payloads under the guise of legitimate cryptocurrency security tools. No specific drainer kit signatures were identified in the available telemetry, but the domain’s structure and branding align with known phishing tactics used against cryptocurrency users. Infrastructure analysis reveals the following technical indicators: the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.47.164. It was created on April 30, 2026, though this date may reflect misconfigured or spoofed registration metadata. The domain is flagged by 11 out of 95 security vendors on VirusTotal, indicating moderate consensus on its malicious nature. It appears on a single security blocklist, specifically PhishDestroy, and was served with an SSL certificate issued by Google Trust Services. Detected technologies include HSTS, Cloudflare CDN, and HTTP/3, suggesting an attempt to appear legitimate through modern web security practices. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, residual risk remains due to potential re-registration or migration of the phishing infrastructure to alternative domains. Users who interacted with the site prior to its takedown should assume credential compromise and take remedial actions, including revoking wallet access, rotating passwords, and scanning for malware. Organizations should monitor for similar domains leveraging Cloudflare Pages infrastructure and Trezor branding, as this tactic may persist in future campaigns.