connect-tr-bridge[.]pages[.]dev

The domain connect-tr-bridge.pages.dev was identified as a brand impersonation phishing site specifically targeting Trezor users. This threat is categorized as a crypto drainer designed to steal cryptocurrency wallet credentials through a fraudulent Trezor Bridge login interface. The domain is currently offline, but during its active period it posed a significant risk to unsuspecting victims. The page title 'Trezor Bridge Login' was crafted to mimic the legitimate Trezor software bridge, luring users into entering sensitive information.

Technical analysis reveals that the domain was registered on May 06, 2026, through Cloudflare, Inc., and resolved to IP address 172.66.47.93. It utilized an SSL certificate issued by Google Trust Services (WE1), which provides a false sense of security. VirusTotal flagged this domain with 7 out of 95 security vendors, and it appeared on one security blocklist. The risk level was assessed as elevated due to the combination of brand impersonation, active SSL, and low blocklist coverage.

Given that the domain is now offline, the immediate threat is contained. However, users should remain vigilant as similar domains may reappear. PhishDestroy recommends verifying any Trezor Bridge login pages by accessing the official Trezor website directly. Never enter seed phrases or passwords on pages accessed via unsolicited links. If you have interacted with this domain, change your credentials immediately and enable two-factor authentication on your cryptocurrency accounts.