e--n-bridge-io[.]pages[.]dev

The domain e--n-bridge-io.pages.dev was identified as a brand impersonation threat targeting Trezor, a popular cryptocurrency hardware wallet. This site attempted to deceive users into believing it was the official Trezor Bridge software, potentially leading to the theft of sensitive credentials or cryptocurrency assets. The phishing kit used is a typical credential-harvesting or seed-phrase-stealing drainer, though no specific kit name was identified.

Technical analysis reveals that this domain was flagged by 11 out of 95 security vendors on VirusTotal, indicating a high level of malicious consensus. It was registered through Cloudflare, Inc. on March 22, 2026, and resolves to IP address 172.66.44.54. The site's SSL certificate was issued by Google Trust Services (WE1), lending it an appearance of legitimacy. The domain appears on one security blocklist, and Google Safe Browsing status was not explicitly provided but given the flagging, it is likely marked as deceptive.

As of the latest check, the domain is offline, suggesting that hosting or DNS services have been taken down, possibly in response to abuse reports. However, users should remain vigilant as similar domains may reappear. PhishDestroy recommends that Trezor users always download software from the official Trezor website only, enable two-factor authentication, and never enter seed phrases into any website. If you have interacted with this domain, change your passwords immediately and contact Trezor support.